babel-preset-lib-client@4.9.11

Analysis

Package named babel-preset-lib-client (a combosquat of a Babel preset name) contains a recon and exfiltration payload in index.js. On execution, it collects the host's public IP (via api[.]ipify[.]org), private IPs, hostname, username, platform, all environment variables (via printenv, base64-encoded), and a directory tree of the parent directory (base64-encoded). All collected data is POSTed as a Discord webhook embed to hxxps://d3doo[.]free[.]beeceptor[.]com. The printenv capture exfiltrates any credentials present in environment variables (NPM_TOKEN, GITHUB_TOKEN, etc.). The package has no repository, no description, and no lifecycle hook — it is a standalone recon tool.