@hibachi-xyz/config@99.0.0

Analysis

On require(), the package's index.js entry point harvests all environment variables matching credential-related patterns (KEY, SECRET, TOKEN, PASS, PRIV, SIGN, AWS, GITHUB, NPM, DOCKER, KUBE, CF_, and others), collects the hostname and username, runs 'whoami && id && cat /proc/1/cgroup' for container fingerprinting, and POSTs the collected data as JSON to jorijo[.]xyz on port 8443 at path /t over HTTPS (with certificate validation disabled). The version 99.0.0 on a scoped name is a dependency-confusion/version-squat pattern designed to be installed automatically by package managers resolving version ranges.