sea-bound-siren @9999.0.4

Summary

On npm install, postinstall.js executes a shell pipeline that collects the output of id , os.hostname() , the full process environment ( env | sort ), the contents of /app/.npmrc , /usr/etc/npmrc , and /root/.npmrc , recursive listings and greps under /app (searching for HTB{...} , secrets, and flag files), and /proc/*/cmdline data. The collected blob is base64-encoded and PUT in two halves over plain HTTP to http://154.57.164.71:30782/api/modules/ECT-* (the destination is hardcoded at postinstall.js line 6 as const TARGET = "http://154.57.164.71:30782"; ). Execution is gated by an isChallengeWorker() check that requires cwd under /app/node_modules , a 12-hex-character hostname (Docker container ID shape), the presence of /app/Cargo.toml or /app/package.json , and explicitly suppresses the payload when the active npm registry is a Chinese mirror (npmmirror, taobao, cnpm, huawei, tencent, ustc) — environment fingerprinting designed to evade researcher and CI sandboxes while firing on the intended victim. Reading and exfiltrating .npmrc exposes //registry.npmjs.org/:_authToken=... tokens, enabling the attacker to publish malicious versions under the installer's npm identity.

Source: amazon-inspector (cd5f2d5cc691968b1bb69f12ea7476c618f6432b42976869906df06312b912c0)