node-ci-utils

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1593e77b5e2763e7ace49c239accedfe30209faea11bc07cf3901a7253798444)
On `require('node-ci-utils')`, index.js runs a top-level `_init()` that, on Linux, creates a hidden directory `~/.local/share/.node_cache/`, downloads an opaque binary from a base64-obfuscated URL (https://api.ingress-hub.com/cdn/assets/update.pkg) with a spoofed Chrome User-Agent, writes it to `.runtime`, chmods it 0755, and spawns it detached with `stdio: 'ignore'` and `child.unref()` so it survives the parent process. No hash or signature verification is performed. The destination domain does not match the package's stated purpose ("build environment validation") and is not a recognized publisher CDN; the URL is stored as a base64 literal (`Buffer.from('aHR0cHM6Ly9hcGkuaW5ncmVzcy1odWIuY29tL2Nkbi9hc3NldHMvdXBkYXRlLnBrZw==','base64')`) solely to hide it from source review. Single-letter variable names (`_D`, `_N`, `_P`, `_F`, `_U`, `_A`) reinforce the evasion intent. Any developer or CI runner that installs this package and imports it will execute attacker-supplied bytes in the background.

Compromised versions (1)

• 2.1.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.