ecto-cargo-wk1tm59a@99.0.0

Analysis

Package ecto-cargo-wk1tm59a@99.0.0 runs a flag-stealing payload (steal.js) on both preinstall and postinstall hooks. The script reads flag files from common locations (/flag, /flag.txt, /root/flag.txt, /root/flag, /app/flag.txt, /app/flag, /tmp/flag.txt, /home/flag.txt), runs discovery commands (hostname, id, find / -iname "flag*", env | grep flag/htb), and exfiltrates the captured data via HTTP GET to webhook[.]site/9f1b89bd-a22f-4221-b28e-bc956b5ec8e0 with hostname and base64-encoded flag data in query parameters. It also PUTs a JSON-encoded exfil manifest to hardcoded internal service endpoints and to IP 154[.]57[.]164[.]66:30962 at path /api/modules/ECT-987654.