date-fns-sync

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8de9cc36a8817e94d67a46762e62e00a58e17077691ea1b4f649bc1f0d49e967)
package.json declares scripts.postinstall = 'node index.js'. index.js reconstructs a URL from a String.fromCharCode integer array — decoding to https://kongregate-api-config.vercel.app/ — fetches JSON from that endpoint, and passes the returned 'token' field directly to eval(). This executes attacker-controlled JavaScript on the installer's machine at npm install time. The destination is not a package publisher domain, the fetched payload is opaque and mutable, and the URL is deliberately concealed via char-code assembly to evade static analysis. The package's README describes it as a caching module, which does not match the observed behavior.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.