sea-bound-sirennpm

The package's postinstall.js fires automatically on npm install and executes a shell pipeline via execFileSync('/bin/sh','-c',...) that collects installer-side data: /app source files (main.rs, Cargo.toml, package.json), full git log/diff/objects, directory listings of /root, /home, /opt, the contents of ~/.npmrc, cron configuration, listening ports, and a recursive grep for HTB{...} flag strings across the filesystem. The collected data is base64-encoded and PUT to http://154.57.164.64:32271/api/modules/ECT-472839 (and an ECT-839201 endpoint), with a 127.0.0.1:32271 mirror. The script gates execution to evade analysis: it bails out when the npm registry hostname matches mirror patterns (npmmirror, tencent, nijin, hscan, ustc, huawei, cnpm, taobao), when GITHUB_ACTIONS / RUNNER_OS / CI environment variables are set, or when cwd is /tmp/, and only proceeds when os.hostname() matches a 12-hex-char pattern (Docker container shape) and cwd contains /app. This is targeted credential and source-code exfiltration with anti-sandbox evasion.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.