Malicious postinstall script found in npm package test-in-one, stealing cryptocurrency wallet files

GitHub Security Advisory reports that the test-in-one package pulls in a local dependency with a postinstall script that runs automatically when the package is installed through npm. The script traverses the home directory, Desktop, Documents, Projects and the current folder, collecting the contents of desktop cryptocurrency wallet directories. Those who installed this package and keep bitcoin wallet files on the same machine are at risk.