cdp-core

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (dbf55b093e3a93e8d3f536101e62e09cf7e86636cd42813d02f518138cbcb8ed)
The package ships cdp_inject.js, which combines child_process, fs, http/https, and base64 encoding to gather system information and exfiltrate it over the network. The file imports http, https, fs, and child_process at the top, reads process.env.USER and other environment data, executes shell utilities (including ping for host reconnaissance), reads files via fs.readFileSync, base64-encodes the collected content (toString('base64') at L205 and L209), and posts it out via https.request/http.get with a hardcoded hostname and POST body. This is the canonical sysinfo+filesystem credential-stealer shape: the package's only on-load effect is to harvest installer-side data and ship it to a network destination. The package name ("cdp-core") and absence of any legitimate library functionality consistent with this code further indicate the file's purpose is exfiltration rather than a documented feature.

Compromised versions (2)

• 1.0.6
• 1.0.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.