search-from-search@999.99.99

Analysis

The package search-from-search@999.99.99 uses dependency confusion (sentinel version 999.99.99) to be installed inside CI pipelines. On npm install, both its preinstall and postinstall hooks run callback.js, which performs extensive system reconnaissance: collects hostname, OS, platform, architecture, user identity (username, uid, gid, homedir, shell), local and external IP addresses, working directory, Node.js version, and CI-environment detection. It then dumps ALL environment variables — including NPM_TOKEN, GITHUB_TOKEN, AWS credentials, and other secrets — and POSTs the entire data payload as JSON to the C2 endpoint at 132[.]243[.]20[.]244:8000/api/collect over plain HTTP.