idx_form_script

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3cc222b7d4398590749d82ffc06100ca629c6e07970a0f95bcf63889fda19cd3)
[email protected] is published with an implausibly high version number characteristic of dependency-confusion attacks against private internal package names. package.json declares a postinstall hook that runs callback.js, which auto-executes on npm install. callback.js requires os, https, http, and child_process, then calls collectSystemInfo() to gather os.userInfo, os.hostname, uid/gid, homedir, platform, cwd, local IP, and external IP (via https.get to api.ipify.org). It reads CI/CD credential environment variables including AWS_ACCESS_KEY_ID, GITHUB_TOKEN, NPM_TOKEN, DOCKER_PASSWORD, GITHUB_REPOSITORY, and GITHUB_ACTOR, and includes their values or presence flags in a JSON payload. The payload is POSTed to a hardcoded Discord webhook at discord.com/api/webhooks/1549797176794943579/..., with an additional DNS-based exfil channel. The package's self-labeling as an 'authorized PoC' is author-controlled cover-story text and does not change the observed behavior: any organization that resolves this name from the public registry will run installer-side reconnaissance and ship credential-context data to an attacker-controlled endpoint.

## Source: ossf-package-analysis (59d074c4d6bd941d9586764043d556a83d301711c58eb661d57d63fa06ebec60)
The OpenSSF Package Analysis project identified 'idx_form_script' @ 999.0.4 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (2)

• 999.0.4
• 999.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.