@sailing-package/core (npm) · Malicious Code

The npm package @sailing-package/core is identified as purpose-built malware that exfiltrates host information and environment secrets during installation. It executes as a postinstall hook, collecting sensitive data such as hostname, username, platform, Node version, IP addresses, and environment variables, which often include tokens and keys. The stolen data is sent to an attacker-controlled Feishu/Lark webhook endpoint using obfuscated encoding methods. The malware includes extensive anti-analysis checks to evade detection in sandbox or CI environments and exits silently if such conditions are detected.