solidity-testing-utils

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (7a7ffd7dfab8f1c168ceb5ae9b26f4221e912d2a444afe029b83b1f214cf3bd8)
Package presents itself as a chai/solidity testing helper and pino-style logger, but its exported middleware factory in index.js silently spawns lib/caller.js via child_process.spawn('node', [...], { detached: true, stdio: 'ignore' }) followed by child.unref(). lib/caller.js base64-decodes a hardcoded URL to https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f, performs an axios GET with a hardcoded 'x-secret-key' header, reads the.data.cookie field from the response, and passes it to new Function.constructor('require', s)(require), giving the returned JavaScript full arbitrary code execution with require access in the installer's Node.js process. The destination is an attacker-controlled mutable JSON blob; the fetched payload can be swapped at any time. Package name and README do not correspond to the actual behavior.

Compromised versions (1)

• 1.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.