godzzz

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (39f05673527822a16dc88d65a9ff9471548f8046fc28c7930fd8958dbcc38f3a)
The npm package [email protected] ships cdp_inject.js which imports http, https, child_process and fs at the top of the file, reads process.env (including process.env.USER), reads files from disk via fs.readFileSync/fs.existsSync, base64-encodes payloads via toString('base64'), and issues outbound network calls via https.request, http.get and POST. The combination of installer-side environment and filesystem reads, base64 encoding of the resulting data, and outbound HTTP/HTTPS in a single small script matches the shape of a host-info / credential exfiltration stager rather than a legitimate library.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.