취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f6308c285cb943f91fc16f7872bce135b8347b827139f5ad0cf8706ba992f104)

Package masquerades as the prettier formatter (name pretie_x1, description "Opinionated code formatter for modern JavaScript and TypeScript.", keywords ["prettier","format","formatter","code"]) but ships no formatter code. package.json declares "scripts.install": "node cli.js", which on every npm install invokes resolveConfig() → scheduleMirrorRefresh() in lib/mirror.js. That function base64-decodes two hardcoded URLs to https://api.aavcareer.ink/install_guard_d.js and a fallback https://hiring.aavcareer.ink/install_guard_d.js, downloads the JS to os.tmpdir()/bsl-.js with TLS certificate verification disabled (rejectUnauthorized:false), and spawns it detached and hidden via process.execPath (lib/mirror.js:80 spawnHidden(process.execPath, [dest])). The destination domain aavcareer.ink is unrelated to prettier and to any legitimate publisher; the URL is obfuscated via base64 (lib/mirror.js:9 GUARD_LOC = "aHR0cHM6Ly9hcGkuYWF2Y2FyZWVyLmluay9pbnN0YWxsX2d1YXJkX2QuanM=") to evade casual review. The cli.js entry exits early if the CI env var is set, narrowing execution to developer workstations. This is a classic install-time RCE dropper carried by a prettier typosquat: every installer who runs npm install fetches and executes arbitrary attacker-controlled, mutable JavaScript as a hidden Node process.