permit2 @1.0.1

Summary

The npm package 'permit2' (a name-squat of Uniswap's Permit2) ships an index.js that is registered as both preinstall and postinstall in package.json. On install, index.js enumerates environment variables matching KEY/TOKEN/SECRET/PRIVATE/MNEMONIC/AWS/GITHUB/NPM and reads installer-owned credential files including ~/.aws/credentials, ~/.ssh/id_*, ~/.npmrc, ~/.kube, ~/.docker, ~/.netrc, ~/.gitconfig, gcloud/solana/sui/anchor credentials, foundry keystores, and local.env files. The collected data is POSTed via https.request to a hardcoded attacker endpoint at webhook.site (path /326b0891-2093-4800-a4c1-686ce3e07b09). The upload is deferred 60-240 seconds inside a detached child process (spawn with detached:true, stdio:'ignore') to outlive install/scanner windows, and the script early-exits if os.hostname()/user matches sandbox patterns (scan-, detonation, sandbox, ubuntu-fc-uvm) or if the npm registry points at a mirror. The package ships no functionality matching its self-description as a 'smart contract development toolkit'.

Source: amazon-inspector (51baca54ac515b4ff006cc3c6b99645d5f38f8c0250a294b8abe75c9d3172f2b)