@convera/ui-shared

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3fa0960816c1204042cecc61c5337e5db2c1407f5325cfc2ed26e43b5dc054d0)
On `npm install`, the package's `preinstall.js` collects `os.hostname()` and `os.userInfo().username` and sends them as query parameters (`/?hn=<hostname>&un=<username>`) via `https.request` to `am0f14nl6o1nqwrngbrq33amfdl496xv.oastify.com`, a Burp Collaborator subdomain. The package ships an empty `index.js` (`module.exports = {}`) and a `package.json` description identifying itself as a 'bug-bounty research placeholder — Convera', published under the `@convera/*` scope to match a private internal namespace. Any installer who resolves this name (accidental scope resolution, misconfigured registry, or a legitimate Convera dev pulling the public registry version) silently leaks host identifiers to a third-party Collaborator endpoint with no opt-in and no functional code in return. Regardless of the author's stated research intent, this is unauthorized data collection from every installer and a dependency-confusion attack surface against the Convera organization.

## Source: ossf-package-analysis (647502d33492bf942a8b0bd468f7420ebca797820c7a47ac74c238c35ae08bff)
The OpenSSF Package Analysis project identified '@convera/ui-shared' @ 0.0.2 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (2)

• 0.0.2
• 0.0.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.