취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fc9b808348f8faf797b0aedc8863482566b3d4a244c20c65f2e65632627a87bd)

The package places 40+ heavily obfuscated JavaScript files (_0xNNNNNN hex-mangled identifiers throughout) inside a hidden .ad/ directory at the tarball root. File names include phone-validator.js, sms-providers.js, smtp-health-cache.js, web-command.js, and a sequential set x0.js through xz.js. The combination of (a) a hidden .ad/ directory designed to evade casual inspection, (b) uniform heavy obfuscation across every shipped module, and (c) module names referencing SMS providers, SMTP health caching, phone validation, and a web-command controller is consistent with a bulk-messaging / spam-relay / abuse-toolkit payload bundled into an npm package. There is no legitimate engineering reason to ship a library's entire functionality as obfuscated bundles under a dotfile directory; this pattern exists specifically to defeat code review and registry scanning. Installers who add this package gain a large attacker-controlled obfuscated codebase that cannot be audited and whose web-command module name suggests remote command/control of installer behavior.