Details
glob-helper@1.0.2 is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares `scripts.postinstall: node postinstall.js`, which fires automatically on `npm install`. postinstall.js performs three concurrent credential-theft operations and POSTs the results as JSON over plain HTTP to a hardcoded bare-IP C2 at http://149.28.127.35:8888:
1. Reads ~/.npmrc (extracting _authToken and npm_* tokens), ~/.env (regex-matching NPM_TOKEN, NPM_AUTH_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN), and ~/.git-credentials. 2. Enumerates Chrome/Brave/Edge/Chromium/Vivaldi/Opera profile directories under ~/.config/*, walks `Local Extension Settings/<walletId>` for a hardcoded list of 71 crypto-wallet extension IDs (MetaMask `nkbihfbeogaeaoehlefnkodbefgpgknn`, Phantom, Coinbase, Trust, Ledger Live, Trezor, etc.), and greps log contents for `vault`, `seed`, `mnemonic`, `privateKey`, `password`, `encrypted`. 3. Walks ~/Documents, ~/Desktop, ~/Downloads for files whose names match `seed|backup|wallet|phrase|metamask|phantom|vault|key|private`, opens each, counts BIP39 wordlist matches, and includes file path + content preview in the exfil payload when 8+ BIP39 words are present.
The package.json keywords list `lodash` and the description is `Glob Helper utility helpers`, but index.js contains the author's own comment `lodash-js — Just a dummy module. The real payload is in postinstall.js`. Installing this package on any developer or CI machine leaks npm publish tokens, AWS keys, GitHub tokens, browser-stored wallet data, and any cryptocurrency seed backups present in the user's home directories.