hyperpure-core@1.0.0

Analysis

hyperpure-core@1.0.0 is a credential-harvesting package with no real functionality. Its preinstall hook collects the hostname, username, current working directory, and all environment variables (base64-encoded) and POSTs them to d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7[.]oast[.]site/install/<base64-encoded-package-name>. The preuninstall hook similarly beacons to d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7[.]oast[.]site/uninstall/hyperpure-core. Stolen env vars may include npm tokens, GitHub tokens, cloud credentials, API keys, and other secrets. The package contains only a stub index.js (module.exports = {name, version}) providing zero utility. Output is suppressed to /dev/null so the exfiltration is invisible during npm install.