es6-codify@2.2.0

Analysis

es6-codify@2.2.0 is a trojanized utility library that exfiltrates environment variables and system metadata on import. At module load, the code POSTs process.env (all environment variables, including any API tokens, npm tokens, cloud credentials, and secrets), process.cwd(), process.version, and command-line arguments to jhyugdawjdxlkanm.casa:443/post-d via HTTPS. The package presents itself as a collection of ES6+ string/array/object helpers with a README and standard build tooling, but the exfiltration runs silently in the background whenever the package is required or imported.