@catamania/ui-components @1.0.1

Summary

The package declares a postinstall lifecycle hook ( "postinstall": "node postinstall.js" in package.json) that runs automatically during npm install . postinstall.js (lines 1-22) collects os.hostname() , os.userInfo().username , process.cwd() , and the entire process.env object, JSON-serializes them, and POSTs the payload over HTTPS to attacker.appsec.cc:9999/exfiltrate . On developer workstations and CI runners, process.env routinely contains high-value secrets (NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, CI provider tokens, database URLs). Errors are swallowed silently, a classic exfiltration-stealth technique. The package self-describes as internal UI components, which provides no legitimate justification for reading or transmitting environment variables. This is an unambiguous credential-theft supply-chain attack against the installer.

Source: amazon-inspector (326cc4cf1fbe96c77b6340df59ebea040cdd522e3e4bc76471563190044cf53a)