x509-escaping

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a0ac597bf732e187011fdef75554843eec3e581b18fdf2c0e83b4dd4aa559731)
package.json declares `preinstall: node index.js`, so on `npm install` the shipped index.js runs automatically. It collects hostname, username, home directory, DNS servers, and current working directory, and reads /etc/passwd and /etc/hosts via fs.readFileSync, then POSTs the bundle over HTTPS to the hardcoded host `agumuj6lhw9yqopq6npl1nlgu70yorcg.oastify.com` (a Burp Collaborator out-of-band subdomain). The package name and single-purpose recon payload match the dependency-confusion reconnaissance pattern: no library functionality is shipped, only install-time data exfiltration to an attacker-controlled OOB host.

Compromised versions (4)

• 0.0.0
• 0.0.1
• 0.0.2
• 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.