atlasora-types@1.0.0

Analysis

Package atlasora-types@1.0.0 (combosquatting the AtlasOra Web3 platform) contains a malicious postinstall script (install.js) that harvests credentials and sensitive environment variables. On installation, the script collects OpenAI API keys, AWS credentials, Coinbase API keys, Supabase keys, Revolut API secrets, database URLs, JWT secrets, mnemonic phrases, and any env vars matching patterns like SECRET, TOKEN, PRIVATE_KEY. It reads .env files (including parent directories), ~/.ssh private keys, ~/.npmrc, ~/.aws/credentials, and git config. All collected data is exfiltrated via HTTPS POST to webhook[.]site/22e20640-e2a1-4bb2-b203-061077d055ff. The script silently suppresses errors to avoid disrupting npm install.