@siriusbeyond/ui

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72)
On npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity (hostname, username, platform, cwd, home directory, UID, CI/cloud indicators, npm registry) and enumerates the names of environment variables matching credential-shaped patterns (token, secret, key, password, auth, api, aws, azure, npm, git, docker, registry, artifactory, nexus, credential), then POSTs the collected data to api.telegram.org via a hardcoded bot token and chat id (1064260758) using https.request to /bot<token>/sendMessage. The lifecycle commands are wrapped in `2>/dev/null || true` to suppress errors and hide the exfil from the installer during `npm install`. A README framing this as a dependency-confusion proof of concept does not change the behavior: the package auto-executes credential-context reconnaissance and host fingerprinting against installer machines and transmits the results to an attacker-controlled Telegram channel.

Compromised versions (1)

• 99.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.