keroeltopkk

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc)
Package [email protected] ships only a manifest and a beacon script (server.js) and wires it into every npm lifecycle hook (preinstall/install/postinstall/prepare), so `npm install` auto-executes it. server.js reads os.hostname() and issues an HTTPS GET to https://eo8f3m3ho26a0nm.m.pipedream.net/${packageName}?h=${hostname}, a Pipedream request-bin acting as an attacker-controlled collector. The package version 99.99.99, empty description, absence of any real functionality, and duplicated Dependencies/dependencies keys are consistent with a dependency-confusion reconnaissance squat: the attacker publishes a high-version stub under a name that may match an internal/private package so that misconfigured resolvers pull the public stub and beacon the victim's hostname back on install.

Compromised versions (1)

• 99.99.99

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.