uisp-connector

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (351b32a85d024168970d1a2e8b7c9c5e6ff6f1d31191390f248a988d9ea6b9a9)
package.json declares `preinstall: node index.js || true`, causing index.js to run automatically on `npm install`. index.js issues a DNS resolution and HTTPS GET to a unique subdomain under `oast.online` (an Interactsh out-of-band collection server). The callback reveals the installer's resolver IP, egress IP, and the fact that an internal build system fetched a package matching this name — the canonical dependency-confusion exfiltration signal. The README self-identifies the package as security research, and the version string contains `security-research`, but an installer cannot distinguish authorized research from real exploitation: the network beacon and information disclosure happen identically in both cases, and whoever controls the Interactsh subdomain receives the data.

## Source: ossf-package-analysis (7387d5655b4341cd75024769045f64a7a2e6315e948c9b2e9789c9704f48ecc7)
The OpenSSF Package Analysis project identified 'uisp-connector' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (3)

• 99.0.0
• 0.0.1-security-research
• 0.0.2-security-research

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.