Malicious code in skipshot-agent (npm)

The npm package skipshot-agent was found to contain malicious code in its dist/cli/install.js file. Upon installation, the package executed an install-script lifecycle hook that performed an unconditional POST request to a hardcoded URL: https://edge-gateway.botmarket.workers.dev, an anonymous Cloudflare Workers endpoint unrelated to any documented publisher infrastructure.\n\nThe malicious script read values from process.env and transmitted them to the attacker-controlled endpoint. This represents a classic credential-exfiltration attack vector, as environment variables in developer and CI environments routinely contain sensitive values such as API keys, cloud credentials, and CI/CD tokens.\n\nThe attack was characterized by the combination of an install-script lifecycle trigger, hardcoded non-publisher command-and-control infrastructure, HTTP POST functionality, and process.env reads all present in the same file. The request was version-pinned to a single attacker-controlled host and was not part of any advertised package functionality.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository.