Compromised npm packages contained malicious 'preinstall' script that executes automatically during installation. Script launches setup.mjs loader that downloads Bun JavaScript runtime from GitHub and executes heavily obfuscated execution.js payload. Payload is an information stealer targeting npm/GitHub tokens, SSH keys, cloud credentials (AWS, Azure, Google Cloud), Kubernetes configs, and CI/CD secrets. On CI runners, embedded Python script reads /proc/<pid>/maps and /proc/<pid>/mem from Runner.Worker process to extract secrets directly from memory. Stolen data is encrypted and uploaded to public GitHub repos under victim's account. Uses GitHub commit searches as dead-drop mechanism with pattern 'OhNoWhatsGoingOnWithGitHub:<base64>'. Includes self-propagation code to modify other packages using stolen credentials.