취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (380f281f71ec04bc9867a9b12d46852936494de6d2be3df55b1422bde2f5f01d)

wm-mapper@99.9.1 is an empty stub (index.js is 35 bytes exporting {}, no description, no author) published at an artificially high version (99.9.1) consistent with dependency-confusion attacks against an internal package of the same name. Its package.json declares its sole runtime dependency as a direct HTTPS tarball URL — "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.7.5.tgz" — bypassing the npm registry entirely. The path segment literally contains depenconf (dependency confusion). On npm install, npm fetches that tarball from an anonymous Google Cloud Storage bucket and executes any lifecycle scripts (preinstall/install/postinstall) it declares. The bucket contents are not vetted by the registry, are mutable server-side after publication, and the bucket owner has no apparent affiliation with the host package. The host package's only effect on installers is to drag arbitrary, swappable, attacker-controlled code into the install tree.

Source: ossf-package-analysis (d3ca8c31fe1e2448adc737f90ef9278202575bc77d3a4a5206e62920219e54a0)

The OpenSSF Package Analysis project identified 'wm-mapper' @ 99.9.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.