test-in-one @1.0.0

Summary

The package declares a local file: dependency ( detector at file:.yalc/detector ) whose postinstall script ( src/scripts/check.js ) executes automatically on npm install . The script walks the installer's home directory, Desktop, Documents, Projects, and cwd to harvest desktop crypto-wallet directories, browser extension LevelDB stores (MetaMask, Phantom, and similar), ~/.ssh/* private keys, ~/.aws/credentials , ~/.git-credentials , .env* , .npmrc / .yarnrc , and the full process.env . The collected files are tarred and POSTed to a hardcoded Telegram Bot API endpoint ( https://api.telegram.org/bot<redacted>/sendDocument , chat_id 416517694). The script additionally contains npm worm scaffolding: after collecting an npm token it calls whoami against registry.npmjs.org , enumerates all packages owned by the maintainer via the registry search API, and for each package downloads the tarball, injects a postinstall hook, bumps the version, writes a .npmrc with the stolen token, and prepares publication (the final publish call is currently gated by if (false) , but token theft, maintainer enumeration, and the injector pipeline are live). Bundling the payload as a file: dependency causes npm to install and run its lifecycle hooks without a registry fetch, making the manifest itself the delivery vector.

Source: amazon-inspector (4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9)