env-fast@1.0.0

Analysis

env-fast@1.0.0 is a trojanized environment-variable loader. The public API (load/parse/config) is a functional decoy. On require(), the module starts a 72-hour delayed timer, after which it collects a system fingerprint (hostname, platform, OS release, architecture, CPU count, total memory, network interface names, home directory, temp directory, uptime, Node.js version) and checks for the existence of ~/.npmrc and SSH private key files (id_rsa, id_ed25519, id_ecdsa). It also counts environment variable names matching patterns like key, secret, token, password, auth, private, wallet, seed, mnemonic. All collected data is POSTed as JSON to 2[.]27[.]62[.]51:8080/api/health. A 6-hourly heartbeat beacon then repeats the same POST to the same endpoint. The package has no install hook — the payload executes when the module is imported, which is the normal usage pattern for an env loader, making the activation transparent to the user.