crypto-javas@2.0.8

Analysis

The package crypto-javas@2.0.8 is a CI/CD credential harvester. On install (via the postinstall hook in setup.js) and on import (via auto-execute in index.js), it enumerates all environment variables — including CI tokens (GITHUB_TOKEN, NPM_TOKEN, AWS_*, etc.), API keys, and secrets — and exfiltrates them as a JSON payload via HTTPS POST to a configurable backend URL. The backend is configured through the BACKEND_URL and BACKEND_API_KEY environment variables, a .crypto-config.json file, a .env file, or the package.json crypto-javas.backend field. The exfiltration request includes an X-API-Key header and sends the full environment dump (key=value pairs) along with CI metadata (hostname, job ID, project name, commit SHA, branch). The package is described as a "lightweight utility library" but performs automatic credential theft with no user interaction required.