@catamania/ui-components

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (326cc4cf1fbe96c77b6340df59ebea040cdd522e3e4bc76471563190044cf53a)
The package declares a postinstall lifecycle hook (`"postinstall": "node postinstall.js"` in package.json) that runs automatically during `npm install`. postinstall.js (lines 1-22) collects `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and the entire `process.env` object, JSON-serializes them, and POSTs the payload over HTTPS to `attacker.appsec.cc:9999/exfiltrate`. On developer workstations and CI runners, `process.env` routinely contains high-value secrets (NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, CI provider tokens, database URLs). Errors are swallowed silently, a classic exfiltration-stealth technique. The package self-describes as internal UI components, which provides no legitimate justification for reading or transmitting environment variables. This is an unambiguous credential-theft supply-chain attack against the installer.

Compromised versions (1)

• 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.