num-format-helper@1.0.0

Analysis

Package num-format-helper@1.0.0 is a combosquat of common number-formatting utility names. Its postinstall.js hook collects the hostname, username, OS details, cloud metadata (AWS 169[.]254[.]169[.]254, Alibaba 100[.]100[.]100[.]200, Tencent metadata[.]tencentyun[.]com), and all environment variables matching KEY/TOKEN/SECRET/CREDENTIAL patterns (including GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, OPENAI_API_KEY, ANTHROPIC_API_KEY, STRIPE_SECRET_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and others). The collected data is base64-encoded and exfiltrated via HTTP GET to pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com/x?d=<base64>. The package also probes tst[.]woa[.]com for connectivity and flag content.