color-convert-helper@1.0.0

Analysis

The package color-convert-helper@1.0.0 is a combosquat of a common utility name. Its postinstall.js lifecycle hook executes a multi-phase reconnaissance and exfiltration payload at install time. Phase 1 collects system information (hostname, user, OS, network config, Docker detection), all GitHub Actions CI environment variables, and every environment variable matching KEY/TOKEN/SECRET/CREDENTIAL patterns. It then scrapes cloud instance metadata from AWS (169[.]254[.]169[.]254/latest/meta-data/iam/security-credentials/), Tencent Cloud (metadata[.]tencentyun[.]com/latest/meta-data/), Alibaba Cloud (100[.]100[.]100[.]200/latest/meta-data/), and Google Cloud (metadata.google.internal/computeMetadata/v1/). Phase 2 performs SSRF probing against tst[.]woa[.]com via /ssrf_forward.php, fetches /flag.html, and exfiltrates results. All collected data is base64-encoded and exfiltrated via HTTP GET requests to pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com on port 80 to paths /d1, /s2, and /s2 with query parameters containing the stolen credentials, cloud metadata, and SSRF results.