search-from-feed@999.0.0

Analysis

Package search-from-feed@999.0.0 runs a host-metadata beacon on npm install via preinstall and postinstall hooks that both execute callback.js. The script collects the victim's hostname, username, home directory, working directory, local IP, external IP (via api[.]ipify[.]org), operating system platform/arch/release, Node.js version, and CI/CD environment metadata (GitHub repository name, GitHub actor, GitLab user login, Jenkins build number, CircleCI/Buildkite/Travis CI status). All collected data is posted to a Discord webhook at discord[.]com/api/webhooks/1516163806559076442 (POST with JSON payload including user, hostname, IPs, cwd, CI details). A secondary DNS callback exfiltration channel encodes base64-truncated host metadata into DNS queries to the Discord webhook hostname. The script also checks for the presence of NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID, and DOCKER_PASSWORD in the process environment to escalate its severity assessment, though it does not exfiltrate the actual token values.