@0xlr/sentry-web

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (6cda998358d5cfe20dc0c060f7e212e44ee41e6f369f42c15badbfdd7b796744)
On `npm install`, this package automatically executes postinstall.js, which enumerates the entire process.env (every environment variable, including CI secrets, AWS_*, NPM_TOKEN, and any other tokens present in the install environment) along with hostname, username, homedir, cwd, argv, platform, arch, and release. The collected payload is POSTed over HTTPS to `rytxau88zxh61dw6qz4yn19naeg54vsk.oastify.com`, a Burp Collaborator out-of-band subdomain used for exfiltration. The package's own description self-identifies as a placeholder squat for the `sentry-web` name, and it ships at version 999.0.0 — a squat-marker version. Installing this package on any machine where credentials are present in the environment results in those credentials being shipped off-host on a single `npm install` invocation.

Compromised versions (1)

• 999.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.