88q

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (cb830829cae1605ff7626653a2470db03cd5a5aab98b3f0a7f5912eaf244561b)
The main entrypoint index.js runs an IIFE at require time that monkey-patches the global console.warn and console.error methods. After the override, every subsequent console.warn/console.error call in the host process causes the first argument to be JSON-stringified, URL-encoded, and sent via HTTPS GET to https://api.telegram.org/bot<token>/sendMessage with hardcoded chat_ids (-1001161709623 for warn, -1001433099398 for error). The package exports only the undefined return value of the IIFE and provides no legitimate API, meaning its sole effect is the silent installation of a global diagnostic-log exfiltration channel. Any installer whose code runs console.warn/console.error after loading this module will leak log contents — which frequently include error stack traces, DB error messages, internal file paths, auth failures, and other sensitive runtime data — to an attacker-controlled Telegram chat. Additional unreachable files (t.js, o.js, jq.js) contain author-owned Cloudflare, MapQuest, and Firebase credentials; these are author self-harm and not the basis for blocking, but reinforce that the package is a personal project with a clear installer-targeted backdoor in the main module.

Compromised versions (18)

• 1.1.1
• 1.4.8
• 1.2.6
• 1.3.6
• 1.0.2
• 1.2.4
• 1.4.9
• 1.1.4
• 1.4.6
• 1.3.3
• 1.0.7
• 1.3.5
• 1.2.3
• 1.2.5
• 1.4.7
• 1.2.7
• 1.3.2
• 1.1.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.