arabsecconf@1.0.0

One or more suspicious static signals were detected.

npm installation triggers the preinstall lifecycle hook.

Secrets from .env and company-secrets.txt files can be exposed in logs or terminal output without consent.

Install-time local secret-file harvesting and console disclosure.

During npm installation, package.json launches preinstall.js. The script collects host and user details, checks Desktop, Documents, and the current project for company-secrets.txt and .env files, reads any it finds, and prints nonblank contents. Although it does not make the displayed attacker URL request, automatic secret harvesting and disclosure during installation is concrete malicious behavior.

This is an automatic install hook that reads likely sensitive files and exposes their contents. The absence of a network request reduces scope but does not make the unconsented harvesting benign.