@across-toolkit/typescript-config@99.0.1

Analysis

@across-toolkit/typescript-config@99.0.1 is a dependency-confusion package impersonating the Across Protocol toolkit. On install, the postinstall.js hook harvests cloud metadata credentials from GCP (metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token) and AWS (169[.]254[.]169[.]254/latest/meta-data/iam/security-credentials/), attempts gcloud CLI token extraction, reads local credential files (~/.aws/credentials, ~/.npmrc, ~/.ssh/id_rsa, ~/.config/gcloud/application_default_credentials.json, ~/.config/gcloud/credentials.db, ~/.config/gcloud/access_tokens.db, .env, .env.local, /proc/1/environ), dumps the entire process environment, and exfiltrates everything via HTTPS POST to webhook[.]site/a585f4ec-20f7-4bd1-bac7-f3e53799dc5f.