secdriven

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e64bd0b65a5cddc6e2032cfdd0a23f06c980a25066490b223d07e1b2e4efe3d8)
On `npm install`, postinstall.js executes `whoami` via child_process and reads os.hostname(), os.platform(), the working directory, and CI / GITHUB_REPOSITORY environment variables, then transmits them as query-string parameters in an HTTPS GET to a hardcoded interactsh subdomain (`lg5ys3jebfzwk366pilidbmah1nsbszh.oastify.com`) under the path `/google/secdriven/`. A DNS lookup using `whoami` output as a subdomain provides a fallback exfiltration channel. The package description ("Security research canary — Google") and README pointing at a Google CTF internal package.json indicate this is a dependency-confusion payload targeting Google's internal namespace; any installer whose resolver picks up this public name leaks host identity, username, working directory, and CI repository path to the third-party OOB-detection endpoint without consent. Whether published as research or attack, the installer-side effect is the same: unconsented identity-and-environment beacon at install time.

## Source: ossf-package-analysis (bafef125d75ec1f8f8b4d9c19e43da29dc8efccecdab347c19a74d1602433535)
The OpenSSF Package Analysis project identified 'secdriven' @ 1.0.8 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

- The package executes one or more commands associated with malicious behavior.

Compromised versions (3)

• 1.0.8
• 1.0.1
• 1.0.7

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.