dotenvv-tool 1.0.1 is a malicious npm package published by owner in.t.re.p.i.d.n.m.w. Its postinstall script (node postinstall.js) harvests npm auth tokens from ~/.npmrc, ~/.git-credentials, .env files (NPM_TOKEN, AWS keys) and npm lines from ~/.bash_history, plus hostname and username, and sends them by HTTP POST to 149.28.127.35:8888. Later versions of the same package add crypto wallet, seed phrase and browser credential theft.