@prime0/pcomatch

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (08299e41eb4feb9e324854bf5cd3386e6e52696b4b11443254374897a1ad3816)
index.js and the postinstall lifecycle script contact a hardcoded bare-IP endpoint at http://69.48.229.140:8080 over plain HTTP. On `npm install`, the postinstall hook collects host identifiers (hostname, username, platform, arch, cwd, node version, pid, all non-internal IP addresses, uptime, package name) and POSTs them as JSON to /b. On `require()` of the package main, the module beacons the same host, then polls /c every 30 seconds for JSON commands and executes the `c` field via child_process.exec, POSTing stdout/stderr back to /r. A source comment self-identifies the module as a stealth typosquat agent, while package.json advertises only a generic "small utility" description.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.