data-parser-utils@3.0.2

Analysis

data-parser-utils@3.0.2 is a trojanized package that fraudulently presents itself as a decimal arithmetic library but contains a credential and data theft payload executed via postinstall hook (node test.js). On npm install, the package scans the victim's filesystem for sensitive files: .env files, cryptocurrency wallet keystores (phantom, metamask, mnemonic, privatekey, seed, trezor, ledger), and documents containing wallet/crypto keywords across home directories and all drive letters (Linux /home/*, Windows C:-J:\, macOS /Users/*). It harvests bash, zsh, fish, and PowerShell shell histories. On Windows and macOS, it locates and archives the Telegram Desktop "tdata" session directory, containing authentication credentials. All stolen data is exfiltrated via multipart POST to hxxps://vercel-backend-green-five[.]vercel[.]app/api/v1. The package also ships a .npmrc file containing a live npm authentication token harvested from a prior victim.