@coopeuch/config

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d)
The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope registry when an organization's scope-to-registry mapping is missing. On npm install, scripts.postinstall executes postinstall.js, which collects host identity (hostname, username, uid/gid, homedir, non-internal network interface addresses and MAC addresses, DNS servers, reverse-DNS internal FQDN), CI/orchestration markers, npm context, container detection via /proc/1/cgroup, and the consuming parent package's name, version, and declared version range, then POSTs the aggregated JSON over HTTPS to the hardcoded author endpoint collector.oob.s4yhii.com/_npm-poc/beacon alongside a DNS beacon under *.oob.s4yhii.com. The behavior fires automatically at install time without consent and reveals internal infrastructure details and private project identifiers of any organization whose build resolves this package from the public registry.

Compromised versions (1)

• 1.999.999

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.