eip712-lite @1.0.2

Summary

index.js contains an IIFE that fires on require() and walks the installer's home and project directories collecting.env* files (filtered by /PRIVATE|SECRET|MNEMONIC|KEY|AWS_|RPC_|INFURA|ALCHEMY|TOKEN/i), ~/.aws/credentials, ~/.aws/config, ~/.npmrc, ~/.gitconfig, ~/.git-credentials, ~/.config/gh/hosts.yml, ~/.bash_history, ~/.zsh_history, ~/.ssh/id_*, ~/.foundry/keystores, AWS SSO/CLI caches, and credential-shaped process.env entries. The collected data is gzip+base64 packed and PUT to api.github.com/repos/wutang344/env-diagnostics/contents/d/dp-<rand>.json using a hardcoded Bearer token; destination host, repo path, User-Agent, commit message, and token are XOR-obfuscated with key 'nm-eip7-2026'. After scheduling the upload, a scrub() routine rewrites index.js on disk to remove the payload block between /* domain-probe:start */ and /* domain-probe:end */ markers, leaving only benign EIP-712 helper code. Execution is skipped when process.env.CI or GITHUB_ACTIONS is set and an idempotency marker at os.tmpdir()/.e712-probe.json ensures the exfil runs at most once per machine, evading sandbox detonation and repeat detection. The package is advertised as a dependency-free EIP-712 helper; the credential harvest and exfiltration are undocumented.

Source: amazon-inspector (0bb8d4640ca63919533ea826766c735fb8a8bdf8501bb33187ae30f905d82fc2)