cloudflare_module

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f3a545e1e930894c3320e68c2aee17dd2cec7f20ed03b2e882905056d0eee242)
Package `[email protected]` is a dependency-confusion lure targeting the `cloudflare_*` namespace. `package.json` declares `scripts.postinstall: "node beacon.cjs"`, and `beacon.cjs` POSTs a JSON payload containing `os.hostname()`, the install path (`__dirname`), `process.cwd()`, and `process.version` to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc` over plain HTTP. The package `main` (`index.js`) additionally calls `require('./beacon.cjs').fire()` at top level inside a try/catch, so the same host-identifier POST also fires whenever a downstream bundler or application `require()`s the package. The default export is a Proxy that returns a no-op for every property access, allowing bundlers that resolve an internal `cloudflare_module` name to complete the build cleanly so the beacon callback fires without producing errors. The package is published at version `99.0.1` with a generic "Compatibility shim." description, consistent with version-bumping to beat an internal registry during resolution. The README self-labels the package as an "authorized dependency-confusion test," but the beacon targets any machine that resolves the name — the installer never consents to the exfiltration — and the destination is an unattributed bare-IP collector, not infrastructure of the targeted namespace.

Compromised versions (4)

• 3.0.0
• 1.0.1
• 1.0.0
• 99.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.