Malicious code in pump-fun-skills (npm)

The npm package pump-fun-skills was published with a malicious postinstall script (index.js) that automatically executes upon installation. The script collects extensive system and credential data from the installer's environment, including hostname, full process environment variables, platform/architecture, output from system commands (whoami, id, uname), /etc/passwd, /etc/shadow, ps aux output, current working directory, package.json, node_modules listing, ~/.npmrc file, and recent npm log files.\n\nAll collected data is exfiltrated via unencrypted HTTP POST requests to the hardcoded attacker-controlled domain 6lsgfv2czhs95it3wc9fpjyovf19pzdo.oastify.com (a Burp Collaborator subdomain). Critically, harvesting the ~/.npmrc file captures the installer's npm registry authentication token, which could enable the attacker to hijack packages published under the victim's identity.\n\nThe package employed typosquatting and impersonation tactics, falsely describing itself as an esbuild netbuild-x64 build and searching the filesystem for directories matching pump.fun and padre.gg to target developers in crypto-frontend ecosystems. The incident was identified and credited to the OpenSSF's malicious-packages repository.