exodus-ethereum-sdk

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b4e52a42f8980da0a9df361ef772ca31bbdaec85eb3fc7a73dbcfc8b5ca6894a)
Package name impersonates the Exodus cryptocurrency wallet brand and ships no real functionality (src/index.js exports an empty object; package.json self-describes as a 'HackerOne PoC'). The package.json declares a postinstall hook (`node src/canary.js`) which fires automatically on `npm install`. src/canary.js performs a DNS lookup and HTTPS GET to a hardcoded `96e03fa6c292469a-172-245-86-254.serveousercontent.com` subdomain — Serveo is an anonymous reverse-tunnel service, so the destination is operator-controlled and not tied to any identifiable publisher. Each install reveals the installer's public IP and DNS resolver to whoever currently controls that tunnel. Combined with the brand-impersonating name (installers may pull this expecting a legitimate Exodus SDK), the package functions as an install-time beacon against unsuspecting installers regardless of the author's stated 'research' intent.

Compromised versions (1)

• 99.0.0-canary.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.