hello244b@1.0.0

Analysis

The package contains only a package.json with a postinstall hook that runs inline JavaScript. On install, the hook collects environment variables matching GITHUB, ACTIONS, RUNNER, AWS, TOKEN, or SECRET patterns; fetches the GitHub Actions OIDC identity token if available; and queries the AWS EC2 instance metadata service (169[.]254[.]169[.]254) for IAM security credentials. All collected data — including env vars, OIDC token, and AWS IAM role credentials — is exfiltrated via HTTPS POST to bcd5-45-241-232-210[.]ngrok-free[.]app with path /?github_attack=1. The package has no repository, no license, and ships no functional code beyond this credential-harvesting lifecycle hook.