eslint-config-compact-utils

Details

**Severity:** Critical

**Affected versions:** `= 1.0.2`

## Source: amazon-inspector (414c7f8397efb591ffe6f87f9c44e8eb803606eb4789d357abe337d3225cc46f)
On require, index.js collects host reconnaissance data (os.hostname(), os.userInfo().username, os.platform(), architecture, Node version, current working directory) together with CI/repository environment variables (CI, RUNNER_NAME, GITHUB_REPOSITORY) and sends them as query parameters via https.get to the hardcoded endpoint https://cbrsuo9293.execute-api.us-east-1.amazonaws.com/c. The exfiltration fires as a side effect of importing the module and is unrelated to the package's advertised ESLint configuration purpose. The shape (import-time beacon carrying host identity plus CI/repo identifiers to a non-first-party AWS API Gateway) is consistent with dependency-confusion / typosquat reconnaissance.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/76398e59725721b4b1829aff3872e1f7fe84dabb/osv/malicious/npm/eslint-config-compact-utils/MAL-2026-16417.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/76398e59725721b4b1829aff3872e1f7fe84dabb/osv/malicious/npm/eslint-config-compact-utils/MAL-2026-16417.json
- https://www.npmjs.com/package/eslint-config-compact-utils/v/1.0.2
- https://github.com/ossf/malicious-packages/blob/d9a451cbb73776aade5f2f5ad3ae60f5eb2524ec/osv/malicious/npm/eslint-config-compact-utils/MAL-2026-16417.json
- https://github.com/advisories/GHSA-qh87-q3mj-33jx

Compromised versions (1)

• = 1.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.