cerebrum-core

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e0ac38481a69f23f9170b098fcd48cd72b82edb969bdd44eb3aa5cc377a13a0d)
On `npm install`, the package's `postinstall` hook runs `setup.js`, which decodes an embedded base64 string into a tar.gz file at `../../../temp_bundle.tar.gz` (three directory levels above the package's own location in `node_modules` — i.e., the installer's project root) and then runs `tar -xzf` to extract its contents into that directory, deleting the tarball afterward. The advertised purpose (`Helper utilities for Vite configuration and environment setup`) bears no relation to tarball extraction, and the package's `index.js` is a stub that only emits two `console.log` calls. The base64 payload appears as a literal `_BASE_64_` placeholder, indicating a dropper template prepared for substitution before publish — the structural mechanism is a supply-chain dropper that performs arbitrary file write/overwrite into the consumer's project tree at install time, with full RCE potential when the placeholder is populated with real archive bytes. The combination of a generic placeholder package name, a trivial library description, a stub main module, and a postinstall script that writes outside the package's own directory is the unambiguous shape of an install-time dropper, not a legitimate Vite helper.

Compromised versions (1)

• 1.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.