Details
Package name impersonates the Auth0 ecosystem. Its postinstall hook (`node index.js`) runs unconditionally on `npm install` and performs a multi-stage data theft against the installer: (1) collects hostname, username, architecture, cwd, local IPs, /etc/resolv.conf,.git HEAD, UID/GID, the host project's package.json (name/version/repo) by walking parent directories, local and home `.npmrc` registry/scope settings, ~40 CI/CD environment variables (GITHUB_*, GITLAB_*, BITBUCKET_*, AWS CodeBuild, Vercel, etc.), and presence flags for ~/.ssh, ~/.aws, ~/.kube, ~/.docker, ~/.npm, ~/.gitconfig, ~/.cargo, ~/.ngrok; (2) when running in cloud, queries the instance metadata service at decimal-encoded 169.254.169.254 (`2852039166`) to extract live AWS IMDSv2 STS tokens, Azure IMDS OAuth tokens, and GCP service-account access tokens, including a 40-character prefix of each token in the payload; (3) DNS-probes ~30 internal-only hostnames (kubernetes.default.svc.cluster.local, vault.internal, consul.service.consul, gitlab.internal, jenkins.internal, ec2.internal, azure.internal, rancher.internal, etc.) to map the victim's internal infrastructure for lateral movement. The exfiltration destination `dep-update-ci-02.lapxa354.workers.dev` is base64-cloaked (`Buffer.from("ZGVwLXVwZGF0ZS1jaS0wMi5sYXB4YTM1NC53b3JrZXJzLmRldg==","base64").toString()`) and the data is sent in fragmented chunks via `https.get` with a 60-second delay as evasion. Code at index.js trims its own `-utils` suffix to derive an inferred host-project name and reports the host project rather than itself, confirming intent as a supply-chain delivery vehicle. User-Agent is `MalekAbuLialaResearch/1.0`.