취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (eb59d96acba76c5d5e2044eae3d7dfeb33bc19f10d75aa04fcf6765ad9b7fde8)

Package @public-for-cdao/token@99.99.99 is a dependency-confusion payload targeting an internal @cdao/token scope. package.json declares a postinstall hook that runs node recon.js, which on npm install collects host identity (os.hostname(), username, platform, cwd), iterates a large list of CI/CD and cloud credential environment variables (including AWS_SECRET_ACCESS_KEY, NPM_TOKEN, GITLAB_* tokens, PRIVATE_KEY, MNEMONIC, DB_PASSWORD), reads .env* files at multiple paths and greps for KEY/SECRET/TOKEN/PASS/PRIVATE/MNEMONIC lines, and enumerates GitLab-runner build directories under /builds/, /home/gitlab-runner/builds/, and /var/lib/gitlab-runner/. The collected data is JSON-serialized and POSTed over HTTPS with rejectUnauthorized:false to two attacker-controlled endpoints: webhook.site/d6d18927-e513-4df7-b019-58bfc64fe0dd and enqoojbegdvxj.x.pipedream.net. The version 99.99.99 and mismatched public scope are consistent with attempting to preempt resolution of an internal package of the same base name.