--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (12870ae203f2612ab2bf9e796583acba17914cd4699909156f86c643fcf51f24) package.json declares postinstall=`node index.js`, which runs automatically on `npm install`. index.js collects host identifiers via os.hostname(), os.userInfo(), and process.cwd(), resolves the external IPv4 address, and POSTs them as JSON to a hardcoded Interactsh-style out-of-band collector at lpzlajzjfkpfeefuzxbv6n5nob7bpuh6e.oast.fun/re…

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fe0926f0a2c1f47072efaac014be38bb00c8e9f31f59badf188b1ed74dd5c2ce) On require of auth-next-gen, index.js loads lib/writer.js, which at module top level performs an axios GET against a base64-obfuscated URL (https://www.jsonkeeper.com/b/GS6NQ, with a second hex-encoded URL https://www.jsonkeeper.com/b/HY6M6 staged the same way) and passes the response body to eval(), yielding arbitrary code execution on the …

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (0fbb555b68c6fa973cbdfe9b7e7e8c752faf3013859c6c9d9d3a2b2dedab256b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the …

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca) index.js runs an async IIFE at module load that performs an outbound fetch to https://www.jsonkeeper.com/b/XVHGD (an anonymous, mutable, public JSON-paste service) and forwards the response's `data.data` field to a worker thread via `worker.postMessage({ type: 'RUN_ERROR_THREAD', payload: data.data })`. The referenced worker module (`./worke…

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c911dfdf99f0c6e13cb9e55883a5c2e17cca0b78d3149e38c0cafb6320ea742) The package advertises itself as Express security middleware (XSS/SQLi protection, input sanitization) but the middleware returned to Express is a no-op that only calls next(). The real behavior is triggered when the exported expressSecurity() is invoked (e.g. via the README-recommended `app.use(expressSecurity())`): index.js spawns a detach…

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (91240d8fb55b7ed4730a41f3a334c633bf1a03afb649fd473cad0c0a25312847) The package's postinstall script reads the installer's machine hostname via os.hostname() and performs a DNS lookup of `<hostname>.0ab1mctv5xigbskwtfusp77dj4pvdx1m.oastify.com`, leaking the hostname to a Burp Suite Collaborator subdomain at `npm install` time without consent. oastify.com is the Burp Collaborator service, commonly used by att…

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c) The package runs vishu.js as a preinstall lifecycle hook on `npm install`. That script fetches the machine's public IP from api.ipify.org, collects os.hostname() and GitHub Actions / CI environment variables (GITHUB_*), and transmits them as query parameters to a hardcoded webhook.site collector URL over HTTPS. It additionally performs a DNS…

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (45df33d93645560085a7efe94308b0e3d846f30c829f2d2804bcdb1245626289) package.json declares `preinstall: node index.js`, which fires automatically on `npm install`. index.js loads child_process/os/https, runs `whoami` and `id`, collects host identifiers (os.hostname, os.platform, os.arch, os.homedir, os.userInfo username/uid/gid/shell, os.type, os.release, process.cwd), and POSTs the collected JSON to a hardco…

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7) On `npm install`, both preinstall and postinstall lifecycle hooks execute index.js, which collects host reconnaissance (os.hostname(), os.userInfo().username, os.homedir(), current working directory, DNS servers from dns.getServers(), and package metadata) and exfiltrates it via DNS lookup and an HTTPS POST to a subdomain of oast.fun (intera…

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ade6fb9a07c6f1417e9569af48b6c638bf12fba7540493b1b38a2d6ba42d101c) @jaymara/jsononifier@1.0.2 is advertised as a JSON formatting utility but ships a covert command-execution primitive that fires on require. index.js loads trigger.js, which checks for sandbox indicators (process.env.CI==='true', NODE_ENV==='test', existence of /.dockerenv) and the platform (win32); when those checks indicate a real Windows w…