sea-bound-siren@9999.0.4

Summary

On npm install, postinstall.js executes a shell pipeline that collects the output of id, os.hostname(), the full process environment (env | sort), the contents of /app/.npmrc, /usr/etc/npmrc, and /root/.npmrc, recursive listings and greps under /app (searching for HTB{...}, secrets, and flag files), and /proc/*/cmdline data. The collected blob is base64-encoded and PUT in two halves over plain HTTP to http://154.57.164.71:30782/api/modules/ECT-* (the destination is hardcoded at postinstall.js line 6 as const TARGET = "http://154.57.164.71:30782";). Execution is gated by an isChallengeWorker() check that requires cwd under /app/node_modules, a 12-hex-character hostname (Docker container ID shape), the presence of /app/Cargo.toml or /app/package.json, and explicitly suppresses the payload when the active npm registry is a Chinese mirror (npmmirror, taobao, cnpm, huawei, tencent, ustc) — environment fingerprinting designed to evade researcher and CI sandboxes while firing on the intended victim. Reading and exfiltrating .npmrc exposes //registry.npmjs.org/:_authToken=... tokens, enabling the attacker to publish malicious versions under the installer's npm identity.

Source: amazon-inspector (cd5f2d5cc691968b1bb69f12ea7476c618f6432b42976869906df06312b912c0)