@public-for-cdao/types@99.99.99

The package's postinstall script (scripts.postinstall = 'node recon.js') runs automatically on `npm install` and performs an installer-side credential and reconnaissance harvest. recon.js collects os.hostname(), platform, arch, user, and cwd; enumerates approximately 40 CI/CD, cloud, and wallet-related environment variables including AWS_SECRET_ACCESS_KEY, NPM_TOKEN, GitLab tokens, database and Redis passwords, PRIVATE_KEY, MNEMONIC, and SEED_PHRASE; reads.env files at common paths via fs.readFileSync; and lists directories under /builds, /home/gitlab-runner/builds/, /tmp/, and /var/lib/gitlab-runner/. The collected JSON payload is POSTed via https.request to webhook.site (path /d6d18927-e513-4df7-b019-58bfc64fe0dd) and to enqoojbegdvxj.x.pipedream.net. The package name (@public-for-cdao/types), the pinned version 99.99.99, index.js exporting `{ name: '@cdao/types', version: '99.99.99' }` as a stub, and the in-file comment 'CryptoDAO Dependency Confusion Reconnaissance Payload' identify this as a targeted dependency-confusion attack against an internal '@cdao/types' package.