The 'pump-fun-skills' npm package version 20.1.1 includes a postinstall script that runs automatically during npm install. This script collects a wide range of sensitive data from the installer's environment, such as hostname, environment variables, system commands output, sensitive system files (/etc/passwd, /etc/shadow), process listings, current working directory contents, npm configuration files including ~/.npmrc (which contains npm registry authentication tokens), and recent npm logs. All collected data is transmitted over plain HTTP to a hardcoded attacker-controlled domain (a Burp Collaborator subdomain). The package also searches for directories related to 'pump.fun' and 'padre.gg', indicating targeted reconnaissance. The package description falsely claims to be an esbuild netbsd-x64 build, serving as a typosquatting lure to deceive developers in targeted crypto-frontend ecosystems. This malicious behavior facilitates credential theft and potential downstream package hijacking under the installer's npm identity.

The malicious postinstall script compromises the confidentiality of the installer's environment by exfiltrating sensitive system information and npm authentication tokens. Theft of npm auth tokens can lead to unauthorized publishing or modification of npm packages under the victim's identity, enabling supply chain attacks. The exposure of system files such as /etc/shadow could also facilitate further local or remote compromise. The use of unencrypted HTTP for data exfiltration increases the risk of interception but does not mitigate the threat. This attack targets developers in specific ecosystems via typosquatting, potentially affecting trust and integrity in those software supply chains.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing 'pump-fun-skills' version 20.1.1 and any similarly named packages that may be typosquatting legitimate dependencies. Review and revoke any npm authentication tokens that may have been exposed by this package. Monitor for unauthorized package publishing under your npm identity. Employ strict package source verification and consider using npm's package integrity features or allowlists to prevent installation of untrusted packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.