aftermath-sui @99.0.0

Summary

The package's preinstall script (setup.js, invoked via scripts.preinstall = 'node setup.js') runs automatically on npm install. It enumerates process.env and filters keys matching /key|secret|token|pass|auth|private|drone|gitea|sui|admin|deploy/i, and additionally collects os.hostname(), os.userInfo().username, process.cwd(), the contents of /etc/hostname, and the output of git remote -v . The collected JSON is POSTed to a hardcoded bare-IP endpoint at https://2.25.140.71:8443/aftermath/npm-dep-conf with TLS certificate verification disabled (rejectUnauthorized:false). The destination is a raw IP unrelated to any legitimate Aftermath Finance / Sui infrastructure, and the package name resembles the Aftermath Finance ecosystem, consistent with a typosquat targeting Sui/Aftermath developers.

Source: amazon-inspector (0157a24eb15337a04879abcb94a3293e67dc6cea5efce56541aaa7a43ab5cd53)