nitro-bundled-dep

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (0bbd4417bf91aba92399be259604511102ec5dfbacebe278a7922cf10c4deac5)
[email protected] ships a stub main module (a Proxy that no-ops any property access) plus beacon.cjs, which runs both from the postinstall lifecycle hook (`node beacon.cjs`) and on top-level require() of index.js. The beacon reads os.hostname(), __dirname (install path), process.cwd(), and process.version and POSTs them over plain HTTP to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The destination is not caller-configurable, is not associated with any published vendor, and has no relationship to the stated package purpose. The package name combined with version 99.0.1 and the inert stub body matches a dependency-confusion shape: an internal name resolved against the public registry at an implausibly high version pulls this beacon into the install, giving the operator of 185.158.107.175 confirmation of the host plus reconnaissance identifiers.

Compromised versions (3)

• 99.0.1
• 2.0.1
• 1.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.