@hibachi-xyz/ui@99.0.0

Analysis

@hibachi-xyz/ui@99.0.0 is a dependency-confusion credential harvester. On require(), index.js iterates all environment variables filtering for patterns matching API keys, tokens, and secrets (KEY, SECRET, TOKEN, PASS, AWS, GITHUB, NPM, DOCKER, KUBE, and others). It collects the hostname, username, and output of whoami/id/cgroup, then POSTs the harvested data as JSON to jorijo[.]xyz:8443/t over HTTPS (with certificate validation disabled). The module exports an empty object, providing no legitimate functionality.