취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9751c370c062cb40bccb874f46679ad3ca8ba9d3b49d0d8ba1f924d9582e53a3)

On npm install, postinstall.js executes whoami and id, reads os.hostname(), os.platform(), process.cwd(), and the CI, GITHUB_REPOSITORY, and NODE_ENV environment variables, then transmits them as querystring parameters over HTTPS to qys3a81jtkh128ob7n3nvg4fz651tvhk.oastify.com (a Burp Collaborator subdomain controlled by a third party). The script additionally performs a DNS lookup of <whoami>.qys3a81jtkh128ob7n3nvg4fz651tvhk.oastify.com, embedding the installer's local username into a DNS query to leak it over a covert channel that succeeds even when outbound HTTP is filtered. The package self-describes as a 'Security research canary' but the dual-channel beacon (HTTPS + DNS) to an attacker-controlled collaborator host fires unconditionally on every install, leaking internal CI identity, repository names, and host identifiers from any environment that installs the package.