eslint-config-compact-base

GHSA-ghfm-6qx4-q8p4

Malicious code in eslint-config-compact-base (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (dbc01e3a8316b2d4e11b34a9c8cbe1cf5bd2af83a6a70052e40a22b54f13f78b)
index.js executes on module load and collects host reconnaissance data — os.platform(), os.hostname(), os.userInfo().username, architecture, Node version, current working directory — together with CI-context environment variables including CI, RUNNER_NAME, and GITHUB_REPOSITORY. The collected values are serialized as query-string parameters and sent via https.get to the hardcoded endpoint https://cbrsuo9293.execute-api.us-east-1.amazonaws.com/c. The behavior fires unconditionally on require(), so any build, install, or CI job that pulls in this ESLint config beacons its host identity and repository name to the attacker-controlled AWS API Gateway. This network activity has no relationship to the package's advertised purpose as an ESLint configuration.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/eslint-config-compact-base/MAL-2026-17157.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/eslint-config-compact-base/MAL-2026-17157.json
- https://www.npmjs.com/package/eslint-config-compact-base/v/1.0.0
- https://github.com/advisories/GHSA-ghfm-6qx4-q8p4

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.