nonenull1@1.0.0

Analysis

The package's main entry point (index.js) is a credential harvester. On require(), it POSTs system metadata (hostname, username, platform, Node version, git email) to crabbing-thong-overhung[.]ngrok-free[.]dev/ping, then reads files from ~/.ssh, ~/.aws, ~/.config, ~/.kube, ~/.docker, ~/.gnupg and any .env files in parent directories, collects environment variables matching token/secret/key/pass/auth patterns, and exfiltrates all of it to crabbing-thong-overhung[.]ngrok-free[.]dev/exfil via HTTPS POST.