Malicious code in @public-for-cdao/config (npm)
-= Per source details. Do not edit below this line.=-
The package ships a postinstall script (recon.js) that runs at npm install time. It collects host identifiers (hostname, platform, arch, username, cwd), enumerates roughly 30 sensitive environment variables (including AWS_SECRET_ACCESS_KEY, NPM_TOKEN, GITLAB_ACCESS_TOKEN, SSH_PRIVATE_KEY, MNEMONIC, DB_PASSWORD), reads.env files from paths such as.env, /app/.env, /root/.env, and greps for lines matching KEY/SECRET/TOKEN/PASS/PRIVATE/MNEMONIC. It also enumerates CI build directories under /builds/, /home/gitlab-runner/builds/, and /var/lib/gitlab-runner/. The collected data is serialized as JSON and HTTP POSTed via https.request to two attacker-controlled collectors: webhook.site/d6d18927-e513-4df7-b019-58bfc64fe0dd and enqoojbegdvxj.x.pipedream.net. The package name and 99.99.99 version are consistent with a dependency-confusion lure targeting an internal @public-for-cdao/config scope.
왜 이 VPI인가 (설명가능 · 실험적)
VPI 산정 기준
| 영향도(기본값(정보 없음)) | 55.00 |
| 악용 신호(추가 악용신호 없음) | ×1.00 |
| VPI | 55.00 |
VPI 공식 vpi-v1 기준