ts-bn-lint-helper@3.1.19

Analysis

The package is an information-stealer that searches the working directory for credential and wallet files — specifically id.json (Solana CLI wallet keypair), config.toml, Config.toml, config.json, env, and .env — reads them, and POSTs them to hxxps://data-stream[.]space/api/v1 as binary attachments. It also collects the victim's shell history from ~/.bash_history, ~/.zsh_history, ~/.fish_history, ~/.sh_history, and PowerShell PSReadLine history, and exfiltrates those too. Each upload is prefixed with the system USER and local IP address for victim identification. The exfiltration endpoint is data-stream[.]space (HTTPS).