online-header

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4b9cc23b20e29ff5e2382e8812e86048148646c43b844f6f73db4581e790f761)
[email protected] is a dependency-confusion squat (name claimed at version 99.0.0 with an inert main entry) whose `preinstall` lifecycle script runs `node callback.js`. callback.js collects host identifiers — `os.hostname()`, `os.userInfo().username`, `__dirname` install path, Node version, `os.platform()` and `os.arch()` — and POSTs them via `https.request` to the hardcoded Burp Collaborator OAST endpoint `https://bixi2qq8pkzaq6byt1e037kuul0co2cr.oastify.com`, with a DNS-based backup channel to the same subdomain. On any build system that resolves `online-header` from the public registry (for example, an internal package of the same name shadowed by this public release), `npm install` automatically transmits the installer's host identity and internal install path to a third-party collector controlled by whoever provisioned the OAST subdomain. The package's self-description as a 'dependency-confusion test' does not change the behavior: installers receive no notice and no opt-out, and the data lands at an endpoint outside their control.

## Source: ossf-package-analysis (161e267d603ad6aae77c0c365e895c8e40538da2c09f746c2183124434509fdc)
The OpenSSF Package Analysis project identified 'online-header' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (1)

• 99.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.