ollama-helpers@0.2.1

Analysis

ollama-helpers is a combosquat package impersonating the legitimate Ollama LLM SDK. On install, its postinstall script collects developer identity — hostname, username, git email (from ~/.gitconfig and ~/.config/git/config), GitHub login and email (from ~/.config/gh/hosts.yml), current working directory path, CI provider environment variables, GIT_AUTHOR_EMAIL/GIT_COMMITTER_EMAIL env vars, and runtime platform info — and POSTs it to npm-package-logger-228835561205[.]europe-west1[.]run[.]app over HTTPS. The package ships a publish script that deliberately creates a fake version history to appear maintained. The source utility files (health-check, cache, connection-pool, etc.) are benign stubs; the entire malicious behaviour is in scripts/postinstall.js.