web3-core-js

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (46f9612aaab12b9656a1f1b5fbd7684fdcd57833bbf76d14b2a243f679cb0977)
package.json declares a lifecycle hook that invokes require('child_process') and execSync with a curl command at install time. This pattern fetches remote content and executes it on the installer's machine as part of `npm install`, before any user code runs. The package name mimics the widely-used web3/web3-core ecosystem while shipping only a lifecycle trigger for remote execution — no library code consistent with the claimed web3 purpose is present. Running `npm install web3-core-js` on any developer or CI machine results in arbitrary attacker-controlled bytes being fetched and executed with the privileges of the installing user.

## Source: ossf-package-analysis (44e1f40536600c94540b0fd722439856b2f118f6090709db7461f5aa06fc2fb4)
The OpenSSF Package Analysis project identified 'web3-core-js' @ 2.0.0 (npm) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.

Compromised versions (2)

• 2.0.0
• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.