configcat-trello-powerup

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5365489bc7a763096bf4be47f80bd47e4513917d8b37ba2754e33ae11983872b)
package.json declares `"preinstall": "node index.js"`, which fires automatically on `npm install`. index.js collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers) and reads sensitive system files (/etc/passwd, /etc/hosts) plus package metadata, then HTTPS POSTs the bundle to a hardcoded Burp Collaborator subdomain `hzklpyrf8gdhgtycz16veroqihobc10q.oastify.com`. The package ships no real functionality — empty description, empty author, and a name resembling a plausible internal Trello/ConfigCat integration — fingerprint of a dependency-confusion squat whose only purpose is to beacon installer-side data to the attacker for follow-on targeting.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.