local-ip-helper@0.1.0

Analysis

Malicious npm package disguised as a local IP address helper. On npm install, the postinstall hook automatically executes a credential and information stealer. The payload scans the user's home directory, all available drives (Windows), /home (Linux), and /Users (macOS) for sensitive files including .env files, Solana wallet keypair files (id.json), config.toml, and any document files (doc/docx/xls/xlsx) whose names contain wallet/credential keywords (key, wallet, seed, mnemonic, metamask, phantom, keystore, privatekey, recovery, etc.). It collects shell command history from bash (.bash_history), zsh (.zsh_history), fish, and PowerShell. On Windows and macOS it exfiltrates the Telegram Desktop session directory (tdata), which contains session keys and authentication data. All stolen files are uploaded via HTTPS multipart POST to parket-server-help[.]vercel[.]app/api/v1, batched in 4 MB chunks, along with the victim's username and platform identifier. The package also reads and uploads the current working directory for the same file types.