atlasora-shared@1.0.0

Analysis

A trojanized combosquat package impersonating the AtlasOra platform shared utilities. The postinstall hook (install.js) automatically executes on npm install and performs broad credential theft: it harvests environment variables (including OPENAI_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, Coinbase API keys, Supabase credentials, Revolut secrets, database URLs, JWT secrets, wallet mnemonics and private keys), reads .env files from the project and parent directories (upward traversal), and steals SSH private keys, git config, npm config (.npmrc), and AWS credentials (~/.aws/credentials). All collected data is exfiltrated via HTTPS POST to webhook[.]site/22e20640-e2a1-4bb2-b203-061077d055ff. The malware silently swallows all errors to avoid breaking npm install.