atlasora-utils@1.0.0

Analysis

A trojanized clone posing as a Web3 utility module. On npm install, its postinstall hook (install.js) silently collects environment variables targeting Coinbase/coinbase, OpenAI, Supabase, Revolut, and AWS credentials, plus any env var matching PRIVATE_KEY, MNEMONIC, SECRET, API_KEY, or TOKEN. It also reads .env files (from the cwd and parent directories), ~/.ssh/ private SSH keys, git config, ~/.npmrc, and ~/.aws/credentials. All stolen data is exfiltrated via HTTPS POST to webhook[.]site/22e20640-e2a1-4bb2-b203-061077d055ff. Errors are silently suppressed so the install appears to succeed normally.