취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (07b57475540583a4a2af3fb2d790f066c2e77742a704b3e5048c118f82cc8185)

intl-ad-routing@99.0.1 is a dependency-confusion squat targeting an internal @livingdesign/react namespace. On npm install, the package's preinstall hook (poc.js) executes shell commands to enumerate the installer's environment (ipconfig /all on Windows, ip a && cat /etc/resolv.conf on Linux) and collects hostname, username, install directory, network interfaces, the full list of process.env keys, and every npm_* environment variable (which can include npm registry auth tokens / _authToken values). The collected JSON is POSTed over HTTPS to d8a5d9pon5bugoc35cngp9hcregcqyezu.oast.me (an interactsh out-of-band collector), and a DNS callback encoding hostname+username is also issued. The package's own description states it is a 'Dependency Confusion PoC' for a bug-bounty program, but the lifecycle code runs on any installer that resolves this public version in place of the intended private package — without the installer's consent — and ships their host identifiers and potentially registry credentials to a third-party collector.