npm package that steals your SSH keys, AWS creds and npm token on npm install
The npm package none123s@1.1.7 has an empty description, no repository and ships just two files — a shell around a payload. Its package.json declares a prepare hook that runs index.js, which reads the host’s SSH private keys (id_rsa, id_ed25519), AWS credentials (~/.aws/credentials) and npm token (~/.npmrc), fingerprints the machine, and POSTs it all to an attacker-controlled ngrok tunnel at an endpoint literally named /exfil — a straight credential grab from any developer machine or CI runner that installs it.
The npm package none123s (version 1.1.7) has an empty description, no source repository and no homepage, and ships only two files — a thin shell around index.js. Nothing about it is a real library.
Its package.json declares a prepare script (node index.js || true). prepare runs on install for git/local installs and when the package is packed — so the payload executes around npm install rather than only when the package is imported.
codelake surfaced it from the live npm feed via its install-hook behaviour pipeline; the sensitive-file reads, the assembled /exfil URL and the outbound POST to an ngrok tunnel are the decisive signals. It is also recorded in OSV as MAL-2026-7024 — this advisory is an independent confirmation and a defensive-indicator record, not a first-catch claim.
1 · Harvests credentials. It reads the host’s SSH private keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519), AWS credentials (~/.aws/credentials) and npm token (~/.npmrc).
2 · Fingerprints the host. It collects os.hostname() and machine details as a recon beacon.
3 · Exfiltrates over an ngrok tunnel. It POSTs the collected data to https://crabbing-thong-overhung.ngrok-free.dev/exfil — a free ngrok tunnel fronting the operator’s collector (a /ping beacon precedes it). Using a disposable ngrok subdomain is a deliberate way to keep the endpoint cheap and hard to block by IP.
Why it matters. A single npm install on a developer machine or CI runner hands the operator that host’s SSH keys, cloud credentials and npm publish token — enough to move laterally, access cloud accounts, and publish further malicious packages.
Detected + classified independently by codelake Research via its install-hook behaviour pipeline · deterministic structural analysis of the packed tarball (package.json prepare hook, sensitive-file reads, assembled /exfil URL, ngrok-tunnel POST). Also recorded in OSV as MAL-2026-7024 — this is an independent confirmation and defensive-indicator record, not a first-catch claim.
This is a confirmed-malware advisory. No working payload or reproduction is published — the behaviour is described from structural analysis, and the exfil endpoint is named as a defensive indicator only. The original artifact is preserved in the codelake archive and available to verified security researchers on request.