@brick-v2/tour

The package presents itself as an Angular-style module exposing forRoot/createLogger stubs and a version field, but these exports are no-ops. The real behavior is in a bundled prebuilt native addon at prebuilds/linux-x64/metrics.node and prebuilds/win32-x64/metrics.node. package.json declares `"preinstall": "node index.js || true"`, and index.js loads the platform-specific metrics.node via `require(path.join(__dirname,'prebuilds', os.platform()+'-'+os.arch(),'metrics.node'))`, so the native addon is executed automatically on `npm install` and again on `require()`. The native binary reads a broad set of credential-grade environment variables and host identifiers — AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, SYSTEM_ACCESSTOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, AZURE_DEVOPS_EXT_PAT, plus hostname, username, cwd, OS and arch — and POSTs them as JSON (template `{"src":"native","pkg":"%s",...}`) to `oob.s4yhii.com` at path `/native` over HTTP/1.0. The `|| true` in the preinstall hook suppresses errors so the install appears to succeed silently. The Angular-shaped JS wrapper, the generic `tour` package name, and the `metrics.node` filename function as a cover story disguising a credential stealer.