취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (68e8941c301603919022f1d67d311d576d5d5efcac7ed7cb0d3526cb71e829d6)

On npm install, the package's postinstall.js runs whoami and reads os.hostname(), os.platform(), the current working directory, and CI-related environment variables (CI, GITHUB_REPOSITORY, NODE_ENV), then transmits them via HTTPS GET and DNS lookup to an interactsh out-of-band collector at lg5ys3jebfzwk366pilidbmah1nsbszh.oastify.com under path /nasa/dds-js-canary/. The package self-describes as a 'Security research canary — NASA VDP', and the name + beacon path indicate a dependency-confusion canary targeting an internal NASA package namespace. Regardless of stated research intent, every installer's machine identity and CI/CD context are sent to a third-party OOB collector without consent at install time.