취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (acbd81f78a40f87b410799545f06c929bc7e7c3f552eeea06254416b3b9e0977)

On npm install, the package's postinstall.js collects host identifiers via os.hostname(), os.userInfo().username, os.platform(), and the current working directory, then POSTs them over HTTPS to kd1tbfhej84bcqde44rq77o79yfp3gr5.oastify.com (a Burp Collaborator out-of-band callback subdomain). The package's own metadata self-identifies as a dependency-confusion proof-of-concept (description: "Dependency confusion PoC - H1-lingtys", payload tag src: 'paypal-dep-confusion-poc'), and the package name is chosen to collide with an internal/private package name so that misconfigured resolvers pull this public version instead. Regardless of bug-bounty intent, every installer's machine identity is leaked to an external attacker-controlled OAST endpoint without consent, automatically, on a default install.

Source: ossf-package-analysis (0a4795bc3b2c513417e92b1547d165f9b6cbb750f437b5bf3ac87e63832087ca)

The OpenSSF Package Analysis project identified 'consumerweb-authflow' @ 4.1.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.