auth-gen-next@1.7.13

Analysis

auth-gen-next@1.7.13 is a trojanized clone of the pino logging library. On require(), it collects all environment variables (including NPM_TOKEN, GITHUB_TOKEN, AWS credentials, and other secrets), the system hostname, platform, username, and MAC addresses, then exfiltrates this data via HTTP POST to jsonkeeper[.]com/b/HY6M6 and json[.]extendsclass[.]com/bin/87d723d36c43. The package also contains heavily obfuscated second-stage code in lib/content.js that connects to the CoinMarketCap API as a cover, performs Ethereum JSON-RPC wallet operations, XOR-decodes strings, and spawns child processes. The package has no repository and its description is a decoy.