@public-for-cdao/types @99.99.99

Summary

The package's postinstall script (scripts.postinstall = 'node recon.js') runs automatically on npm install and performs an installer-side credential and reconnaissance harvest. recon.js collects os.hostname(), platform, arch, user, and cwd; enumerates approximately 40 CI/CD, cloud, and wallet-related environment variables including AWS_SECRET_ACCESS_KEY, NPM_TOKEN, GitLab tokens, database and Redis passwords, PRIVATE_KEY, MNEMONIC, and SEED_PHRASE; reads.env files at common paths via fs.readFileSync; and lists directories under /builds, /home/gitlab-runner/builds/, /tmp/, and /var/lib/gitlab-runner/. The collected JSON payload is POSTed via https.request to webhook.site (path /d6d18927-e513-4df7-b019-58bfc64fe0dd) and to enqoojbegdvxj.x.pipedream.net. The package name (@public-for-cdao/types), the pinned version 99.99.99, index.js exporting { name: '@cdao/types', version: '99.99.99' } as a stub, and the in-file comment 'CryptoDAO Dependency Confusion Reconnaissance Payload' identify this as a targeted dependency-confusion attack against an internal '@cdao/types' package.

Source: amazon-inspector (5b1047a119646917a21b103985170a9e993dee0d95a7b6f1f261ddea944b3bf5)