Malicious code in getd-typescript-eslint-rules (npm)
-= Per source details. Do not edit below this line.=-
On npm install, the postinstall.js script collects the installer's hostname, OS username, platform, current working directory, CI environment markers (CI, BUILD_BUILDID, AGENT_NAME), and package name/version, then sends them as query parameters in an HTTPS GET to a hardcoded webhook.site collector (https://webhook.site/18dc4281-d366-438a-9186-76fbcd56ade5). Errors are swallowed so the install does not fail visibly. The package's own metadata declares it a typosquat targeting @getd/typescript-eslint-rules and frames the beacon as 'defensive security research,' but the on-install behavior identifies any installer (including internal CI build agents) to a third-party endpoint regardless of stated intent.
왜 이 VPI인가 (설명가능 · 실험적)
VPI 산정 기준
| 영향도(기본값(정보 없음)) | 55.00 |
| 악용 신호(추가 악용신호 없음) | ×1.00 |
| VPI | 55.00 |
VPI 공식 vpi-v1 기준