aftermath-finance@99.0.0

Analysis

Three combosquat packages (aftermath-finance, aftermathfi, aftermath-sui) targeting the Aftermath Finance SDK. On npm install, the preinstall hook runs setup.js which collects environment variables matching key/secret/token/pass/auth/private/sui/admin/deploy, the system hostname, username, current working directory, and git remote URLs, then exfiltrates the data as a JSON POST to 2[.]25[.]140[.]71:8443/aftermath/npm-dep-conf over HTTPS (with certificate validation disabled). The packages contain no legitimate SDK code — only the credential-harvesting payload.