Malicious code in chalkdevx (npm)

__

Source: amazon-inspector (3e6c8e970ad81ccd02b4725232cbd0d145a20f08e42983097229563e35cac8ad)

package.json declares a postinstall hook that runs.init.js on npm install. The script enumerates ~65 credential and CI environment variables (NPM_TOKEN, GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, STRIPE_*, DOCKER_*, cloud provider tokens, private keys), reads home-directory credential files including ~/.npmrc, ~/.env*, config.json, and credentials.json, and scans ~/.config for files matching token/cred/secret patterns. Collected data — together with host identifiers (os.hostname(), os.platform(), cwd, pid) — is POSTed as JSON to a hardcoded https://webhook.cool/at/tender-deer-80/... endpoint, a public webhook-inspection service unrelated to any declared package purpose. The package's declared functionality is trivial (empty description, minimal index.js); the credential-harvesting postinstall is the package's actual behavior. The name resembles the popular chalk package.