[email protected] executes a postinstall script that accesses the root project's .env file by resolving the installation directory via process.env.INIT_CWD or process.cwd(). It parses the .env file using dotenv and sends the full parsed key/value pairs as JSON to a remote HTTP endpoint. The endpoint URL is obfuscated by splitting it into two base58-encoded fragments concatenated and decoded at runtime, with an in-source comment noting the use of this alphabet to hide the endpoint. Errors during this process are suppressed, preventing npm install from alerting the user. The package's README is unrelated and copied from another project, indicating deceptive intent. This behavior results in the leakage of sensitive environment variables commonly stored in .env files.

Sensitive environment variables including database credentials, cloud provider keys, and API tokens stored in the .env file of the affected project are exfiltrated to an attacker-controlled remote server during package installation. This can lead to unauthorized access to critical infrastructure, data breaches, and further compromise of the affected environment. The malicious behavior is stealthy, as errors are suppressed and the package masquerades as a legitimate crypto-price fetching tool, increasing the risk of unnoticed compromise.

No official patch or remediation is currently available for [email protected]. Users should immediately remove this package from their projects and avoid installing it. Audit dependencies for malicious or suspicious packages, especially those with unexpected postinstall scripts. Review and rotate any secrets that may have been exposed via .env files if this package was installed. Use trusted sources and verify package authenticity before installation. Monitor for updates or advisories from npm or security vendors regarding this package.