@public-for-cdao/common @99.99.99

Summary

Package declares a postinstall hook that runs recon.js on npm install . recon.js reads a broad list of secret-bearing environment variables (AWS_SECRET_ACCESS_KEY, NPM_TOKEN, SSH_PRIVATE_KEY, MNEMONIC, GitLab and CI_* tokens, DB/Redis passwords) and scans common.env file paths including /root/.env, /app/.env, and /home/gitlab-runner/.env for KEY/SECRET/TOKEN/PASS/PRIVATE/MNEMONIC matches. The harvested payload plus host identifiers is POSTed to two hardcoded non-first-party endpoints, webhook.site/d6d18927-e513-4df7-b019-58bfc64fe0dd and enqoojbegdvxj.x.pipedream.net, over HTTPS with certificate verification disabled (rejectUnauthorized:false). The package is published at version 99.99.99 under the public scope @public-for-cdao while index.js identifies itself as @cdao/common, and a source comment self-labels it a 'CryptoDAO Dependency Confusion Reconnaissance Payload' — the shape of a dependency-confusion attack against CI/CD builds that misroute an internal @cdao scope to the public registry.

Source: amazon-inspector (28545511de9101d471f9f9184bd6b86c16380ab3f4740f3772e794ce270b6aa5)