@design-system-coopeuch/web

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a871445c3913d747a2f1383bcfdac02d6dec26ddb2053260340284cf4ee02233)
Package `@design-system-coopeuch/web@999.0.4` is a dependency-confusion squat of an internal-looking scope, published at an inflated 999.x version to override any private registry copy. `package.json` declares a `preinstall` hook that runs `cb.js`, which collects installer host identifiers (`os.hostname()`, cwd, install directory, `id`, `uname -a`, OS release info, and the full list of `process.env` key names) and POSTs them as JSON over cleartext HTTP to a hardcoded bare IP, `http://157.173.126.113:8443/dep-confusion` (cb.js line 20: `hostname: "157.173.126.113", port: 8443, path: "/dep-confusion", method: "POST"`). The beacon fires automatically on `npm install` without user consent. Although the package description self-labels as an "authorized bug bounty PoC," any unintended installer has their host fingerprint exfiltrated to an attacker-controlled endpoint. The combination of internal-scope impersonation, inflated version, and install-time beacon to a bare IP is the canonical dependency-confusion attack shape.

## Source: ossf-package-analysis (e91609499d64cf31c94ddc3047d4c189c64e8e5f09c3da98cb3fec5c05978823)
The OpenSSF Package Analysis project identified '@design-system-coopeuch/web' @ 999.0.0 (npm) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.

Compromised versions (2)

• 999.0.0
• 999.0.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.