@pluxee-connect/account-db-api-client

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (49a36af66b1c55fbf7a78529c1fe2d15b819cef018300a03cdc8e0a1b59f36c9)
Version 99.0.0 of this package targets an internal-looking npm scope and ships a postinstall.js that, on every `npm install`, reads os.hostname(), os.userInfo().username, process.version, and the package name and transmits them to the third-party OAST domain `d84t2rmqt3fpphmbii3gf9sdi63c3gkp7.oast.online` over both HTTP GET (port 80) and DNS lookup. The package's main entry (index.js) is a placeholder stub containing only a ConsentsStatus enum with a comment self-describing it as a `PoC stub` mirroring the real package's API. The combination of an inflated 99.0.0 version, a hollow API surface, and an unconditional install-time beacon to an interactsh out-of-band exfiltration host on a scope that resembles an internal Pluxee namespace is a textbook dependency-confusion attack: any build system misresolving the internal name to this public package leaks host identity to the attacker's OAST listener.

## Source: ossf-package-analysis (b7d101dbff5c071f3bab34e97f3d340e0b52caa00e38ef82e630864d44a7dce3)
The OpenSSF Package Analysis project identified '@pluxee-connect/account-db-api-client' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (2)

• 99.0.0
• 99.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.