Malicious code in unico-check (npm)
-= Per source details. Do not edit below this line.=-
package.json declares a preinstall lifecycle hook that runs curl against https://webhook.site/fe1246c2-ac04-4493-b223-fe34ba26b79f, passing the installer's hostname, current user, working directory, full uname -a output, and $HOME as query parameters. The beacon fires automatically on npm install with no user interaction. The package ships no source files, declares no main entry, and uses the implausible version 9.9.9 — the canonical shape of a dependency-confusion / typosquat reconnaissance package targeting builds that may resolve a private unico-check from the public registry. The package's only effect on installation is to leak host identifiers to an anonymous, attacker-controlled webhook.site bin, staging follow-on compromise.
왜 이 VPI인가 (설명가능 · 실험적)
VPI 산정 기준
| 영향도(기본값(정보 없음)) | 55.00 |
| 악용 신호(추가 악용신호 없음) | ×1.00 |
| VPI | 55.00 |
VPI 공식 vpi-v1 기준