취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (351b32a85d024168970d1a2e8b7c9c5e6ff6f1d31191390f248a988d9ea6b9a9)

package.json declares preinstall: node index.js || true, causing index.js to run automatically on npm install. index.js issues a DNS resolution and HTTPS GET to a unique subdomain under oast.online (an Interactsh out-of-band collection server). The callback reveals the installer's resolver IP, egress IP, and the fact that an internal build system fetched a package matching this name — the canonical dependency-confusion exfiltration signal. The README self-identifies the package as security research, and the version string contains security-research, but an installer cannot distinguish authorized research from real exploitation: the network beacon and information disclosure happen identically in both cases, and whoever controls the Interactsh subdomain receives the data.

Source: ossf-package-analysis (7387d5655b4341cd75024769045f64a7a2e6315e948c9b2e9789c9704f48ecc7)

The OpenSSF Package Analysis project identified 'uisp-connector' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.