ledger-lib@1.0.1

One or more suspicious static signals were detected.

npm installation executes the postinstall lifecycle hook.

Theft of npm tokens, cloud credentials, SSH keys, cryptocurrency wallet material, environment secrets, and Git configuration.

install-time credential harvesting and HTTPS exfiltration

On npm installation, package.json invokes postinstall.js. That script gathers named secret-bearing files, scans hidden home directories for likely wallet/key material, adds host and username metadata, then sends the serialized collection by HTTPS POST to a fixed Pipedream endpoint. Errors are suppressed, consistent with covert best-effort harvesting.

Direct source inspection confirms an automatic install-time credential and wallet-file exfiltration chain. This is concrete malicious behavior, not a noisy static signal.