zluri-ad-connector

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1b7a807f066f0255f7480ebd7d445043282260b464b0ef54a32a2d022c93bbf7)
The package declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js requires `os`, `dns`, `https`, `querystring`, and the local `package.json`, then harvests values from `process.env` matching a large sensitive-token allowlist (npm, GitHub, AWS, CI tokens, and generic `secret`/`token`/`password`/`api_key` names) along with `os.hostname()`, `os.userInfo()`, `os.platform()`, homedir, PATH, DNS server list, and package metadata. The collected bundle is POSTed over HTTPS to `y543452sgo96xsasfdr72ms4rvxmld92.oastify.com`, a Burp Collaborator subdomain used as an attacker-controlled exfiltration sink. The package name `zluri-ad-connector` combined with the canonical dependency-confusion version `9.9.9` indicates an intentional attempt to shadow a private Zluri internal package name so that CI resolvers pull this public malicious package.

## Source: ossf-package-analysis (04e770be48b9eacfda9794e0b5865d9fb1a0232dfa90b97bfc05c75cb92dc8fe)
The OpenSSF Package Analysis project identified 'zluri-ad-connector' @ 9.9.9 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (1)

• 9.9.9

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.