0vulns-dependency-confusion-poc

Details

The package communicates with a domain associated with malicious activity.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3d282025fb2ec1b4012e3b979cec1f66520e643fcadfd2864e54989de50dd00d)
The package.json preinstall script runs `wget` against an attacker-controlled webhook.site URL, passing `$(whoami)`, `$(pwd)`, and `$(hostname)` as query parameters, executing automatically on `npm install`. This matches the npm-lifecycle-external-fetch and credential/telemetry exfiltration patterns (findings a static pattern match, a static pattern match, a static pattern match, a static pattern match, a static pattern match). the analysis confirms contextually that the script performs reconnaissance exfiltration to a non-registry collector, and config.unsafe-perm is set to ensure execution. the analysis further notes that the declared main entrypoint is missing and the tarball contains only package.json — the package exists solely to trigger the beacon, with no legitimate runtime functionality. Self-identification as a 'PoC' does not change the risk to an unintended installer (e.g., via dependency confusion).

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.