Malicious code in shop-minis (npm)
-= Per source details. Do not edit below this line.=-
On npm install, the package's postinstall script (postinstall.js, run via scripts.postinstall = 'node postinstall.js') collects host identity — whoami, id, os.hostname(), os.platform(), current working directory, and the env vars CI, GITHUB_REPOSITORY, NODE_ENV — and sends them to the hardcoded attacker-controlled host svr57aylqme3zald4p0psi1hw827q1eq.oastify.com (a Burp Collaborator / OAST canary domain) via both https.get and DNS lookup. The package name shop-minis and self-described 'Security research canary — shopify' impersonate Shopify's Shop Minis platform, so any developer expecting that namespace would unwittingly leak host recon to the canary operator's collaborator instance. The package ships no real functionality matching its name; the only effect of installation is the exfiltration beacon.
왜 이 VPI인가 (설명가능 · 실험적)
VPI 산정 기준
| 영향도(기본값(정보 없음)) | 55.00 |
| 악용 신호(추가 악용신호 없음) | ×1.00 |
| VPI | 55.00 |
VPI 공식 vpi-v1 기준