kuaishou@99.9.9

Analysis

Package ships only a package.json with a malicious prepare lifecycle hook. On install, the hook collects the hostname, platform, username, and full process environment variables, then POSTs them to crabbing-thong-overhung[.]ngrok-free[.]dev/?cross_os_cloud=1. If running in a GitHub Actions CI context (ACTIONS_ID_TOKEN_REQUEST_URL is set), it additionally fetches the OIDC identity token and exfiltrates it to the same endpoint, enabling cloud-credential theft via token exchange.