cre-setup

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (fcc14c964a76dde24165930e971dac9a2a9f36ecae68d596c7bf920cac8e1c29)
bin/cli.js collects the current user (`whoami`/`os.userInfo()`), `os.hostname()`, and `os.platform()` and POSTs them, along with URL query parameters carrying the same values, to the hardcoded endpoint https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9 on invocation. There is no configuration option, no opt-in, and no documented purpose that requires transmitting installer/runner identity off-host. The destination is an out-of-band callback URL under an individual-controlled Cloudflare Workers subdomain, characteristic of dependency-confusion / npx reconnaissance beacons.

## Source: ossf-package-analysis (7a338301f299dfbe6fb5f4a0e2f0ca15e3a26765b411205b9cc9a74178660283)
The OpenSSF Package Analysis project identified 'cre-setup' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

- The package executes one or more commands associated with malicious behavior.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.