chart-data-utils@1.0.0

Analysis

chart-data-utils@1.0.0 ships a benign decoy index.js (color utilities) but executes a multi-phase recon and credential-exfiltration payload in its postinstall hook. The payload collects: (A) GitHub CI environment variables (repository, actor, ref, job, run ID, event, workflow, runner), hostname, user identity, cgroup, Docker detection, OS/kernel, and working directory; (B) DNS and HTTP reachability of tst[.]woa[.]com; (C) all environment variables matching KEY/TOKEN/SECRET/CREDENTIAL/KUBE/JENKINS/NPM_TOKEN/GITHUB_TOKEN/AWS_ patterns; (D) sudo privileges, process list, network interfaces, and routing table; (E) cloud metadata from Tencent Cloud (metadata[.]tencentyun[.]com), AWS (169[.]254[.]169[.]254), Alibaba Cloud (100[.]100[.]100[.]200), and GCP (metadata.google.internal). All collected data is base64-encoded and exfiltrated via HTTP GET requests to pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com under paths /a through /e.