exxpress-utils@1.0.5

The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The script performs three attacker-benefit actions concurrently: (1) reads `~/.npmrc`, `~/.env`, and `~/.git-credentials` and extracts npm `_authToken` / `npm_<36>` tokens, `NPM_TOKEN`, `NPM_AUTH_TOKEN`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`, and git URLs with embedded credentials; (2) enumerates Chrome / Brave / Edge / Chromium / Vivaldi / Opera profile directories under `Local Extension Settings/<walletId>` for 71 hardcoded crypto-wallet extension IDs (MetaMask `nkbihfbeogaeaoehlefnkodbefgpgknn`, Phantom, Coinbase Wallet, Trust Wallet, Ledger, Trezor, etc.) and regex-scans their logs for vault/seed/mnemonic/privateKey/password patterns; (3) walks `~/Documents`, `~/Desktop`, `~/Downloads` for files matching crypto-keyword names and reads their contents. Harvested JSON is POSTed to the hardcoded C2 `http://149.28.127.35:8888` over plain HTTP via `http.request`. The package name is a double-x typosquat of `express`; the advertised purpose is 'utility helpers', `index.js` is a no-op stub whose `description` contradicts the package name ('Lodash JavaScript utilities bundle'), and `postinstall.js` contains self-incriminating header comments ('Token harvester + Crypto wallet scanner', 'Silent. Zero trace.'). Every structural fingerprint of a credential/wallet stealer is present: hardcoded C2 bound to `http.request` in a lifecycle hook, browser wallet-extension-ID lookup, seed-phrase directory scanner, and token-regex extraction from `~/.npmrc` / `~/.env` / `~/.git-credentials`.