auth0.net

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (299295a8f62b96e6336a60ce85d2212185bf0cf424cc548d8bca9f0b14ed85c1)
On `npm install`, package.json's `preinstall` (and `preupdate`/`test`) hook runs `nslookup bkxajsfkvlurhaoeotqbqf3fg2sitbxll.oast.fun`. The destination `oast.fun` is the Project Discovery interactsh out-of-band callback service used to confirm code execution on victim hosts via a unique DNS subdomain. Firing automatically on install leaks the installer's existence and the corporate DNS resolver's egress IP to an attacker-controlled nameserver, with the unique subdomain serving as a per-victim correlation token. The package itself is hollow — `index.js` is empty, `description` is the placeholder 'Internal package', and `author` is 'Team' — and the package name `auth0.net` impersonates the Auth0 brand, consistent with a dependency-confusion attempt against an internal Auth0/.NET package name. The DNS beacon is the recon stage of that attack: the operator learns which organizations have misconfigured their registry resolution to pull this public package instead of an internal one, enabling targeted follow-on compromise.

Compromised versions (2)

• 7.22.1
• 39.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.