@galicia-toolkit-nestjs-20/paas

On require('@galicia-toolkit-nestjs-20/paas'), index.js unconditionally loads prebuilds/<platform>-<arch>/metrics.node at module top level inside a try/catch. The shipped ELF addon reads AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_RUNTIME_TOKEN, and ACTIONS_ID_TOKEN_REQUEST_TOKEN from the process environment, together with hostname, uid, and cwd, and POSTs them as JSON to oob.s4yhii.com over a raw socket (gethostbyname/connect/send, request line 'POST /native HTTP/1.0'). The addon uses fork+setsid to background the exfiltration. The package ships no C/C++ source and no binding.gyp, is self-labeled as a NestJS toolkit, and the only on-load effect of the stub is to execute this opaque native binary. Strings observed inside metrics.node include 'AWS_SECRET_ACCESS_KEY', 'GITHUB_TOKEN', 'NPM_TOKEN', 'ACTIONS_RUNTIME_TOKEN', 'oob.s4yhii.com', and the hardcoded HTTP request format. The scoped name under an organization-shaped '@galicia-toolkit-nestjs-20' namespace combined with the implausibly high 999.0.1 version is consistent with a dependency-confusion lure designed to win resolution against an internal package.