Details
The package declares a postinstall hook (`node dist/script.js`) while its declared main entry (`dist/index.js`) is an inert 105-byte stub, so the entire behavior fires at `npm install` time. The postinstall script walks the installer's home directory and common workspace folders (Desktop, Documents, Downloads, Projects, Backups) and (1) reads browser wallet extension profiles for MetaMask, Phantom, Trust, Coinbase, OKX, Rabby, Keplr, Solflare, TronLink, Ronin, and Exodus, along with desktop wallet stores for Exodus, Electrum, Bitcoin Core, Ledger Live, Trezor Suite, Wasabi, and Sparrow, plus any files matching seed/mnemonic/bip39/privatekey/keystore keywords; (2) enumerates a hardcoded list of sensitive files including `.env*`, `.npmrc`, `.yarnrc`, `.pnpmrc`, `.netrc`, `.git-credentials`, `.gitconfig`, `id_rsa`/`id_ed25519`/`id_ecdsa`, `.pem`/`private.key`, `aws.json`, `gcloud.json`, `service-account.json`, and `firebase-adminsdk.json`. Collected material is packaged with `tar` and uploaded to a hardcoded Telegram bot endpoint at `https://api.telegram.org/bot<BOT_TOKEN>/sendDocument`. The script additionally harvests the installer's npm auth token, writes `//registry.npmjs.org/:_authToken=${token}` into an `.npmrc`, queries `registry.npmjs.org/-/whoami` and `registry.npmjs.org/-/v1/search` to enumerate the victim maintainer's other packages, and copies its own `dist` payload into them via `fs.cp('dist', pathToInject, { recursive: true })` to republish malicious versions under the victim's identity.