The create-coin package version 20.1.1 includes a postinstall script that runs build/payload.node.js during npm install. This script implements anti-analysis techniques by detecting CI environments, containerization, and minimal environment variables, then delays execution randomly between 10 and 30 seconds. It reads the installer's npm configuration files, enumerates all environment variables, and accesses project files such as package.json, package-lock.json, .env, and src/config.*. It also gathers host reconnaissance data via system calls and probes open localhost ports. All collected information is sent via HTTPS POST to a hardcoded endpoint (https://random-name.trycloudflare.com) with SSL verification disabled. The script suppresses errors and forces a successful exit code to avoid detection. The package description falsely claims to be related to esbuild, suggesting a typosquatting attempt to impersonate a known package family.

This malicious package can lead to significant information disclosure by exfiltrating sensitive environment variables, project configuration files, and host system details to an attacker-controlled server. This can compromise credentials, secrets, and internal project data, potentially enabling further attacks or unauthorized access. The stealthy nature of the code, including anti-analysis checks and error suppression, increases the risk of unnoticed compromise during routine npm installs.

No official patch or remediation is currently documented. Users should avoid installing [email protected] and verify package authenticity before installation. Use trusted package sources and consider scanning dependencies for malicious behavior. Monitor for suspicious network connections to unknown endpoints during npm installs. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.