취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e82942b1fcdaed1a1085ad9590ef93704e276c5c5ca1622884abac014f03980f)

package.json declares "preinstall": "./scripts/postbuild", where scripts/postbuild is a 976,568-byte unsigned, unhashed, unversioned Linux ELF executable shipped in the tarball. The package's only JavaScript source (src/index.js) is a trivial stub that exports () => { console.log("hello") }, with the bundled output (dist/index.cjs.js) matching. Nothing in the package's stated Arweave/Warp-contracts wrapper purpose justifies a native executable, and the binary's embedded strings (LIBBPF_0.0, PTRACE, NETLINK, HTTP/1.1, USERPROFILE, RSA_PKCS1_, Ed25519) indicate credential-handling and network-agent capabilities rather than build tooling. On npm install, the binary runs with the installer's privileges before any user inspection; the JS stub is a cover for shipping and executing arbitrary native code. The package name testnpmnmp and stub source further indicate a throwaway dropper rather than a real library.