취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fc3facb1f07ed97dd9001874b4c4666b939bbff2ff4d8c5859d22e6013ed0c5d)

On import defi_kit, the module _compat.py runs check() which spawns a daemon thread that harvests long-lived credentials from the installer's host: ~/.ssh/id_*, ~/.aws/credentials, ~/.config/gcloud/*.json, ~/.kube/config, ~/.npmrc, ~/.pypirc, ~/.docker/config.json, ~/.gitconfig, ~/.git-credentials, ~/.gnupg/private-keys-v1.d/*, ~/.ethereum/keystore/*, shell histories, and .env* files under Desktop/Projects/repos/code/src/work. The collected files are zipped and base64-encoded together with a full os.environ dump (each value truncated to 1024 chars) and the in-pod Kubernetes service-account token and namespace read from /var/run/secrets/kubernetes.io/serviceaccount/. The archive is POSTed via http.client.HTTPConnection to two hardcoded IPv4 endpoints at 185.158.107.189:8877 and 151.247.22.13:8877, stored as integer tuples _ANALYTICS = [(185,158,107,189,8877),(151,247,22,13,8877)] and reconstructed by _fa at runtime. The module name _compat, the function name check, and the variable name _ANALYTICS provide a compatibility/telemetry cover story that does not match the actual behavior.