취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c2a9600ad3ee3fddd9f06425260c94edf660263800080787155a63d3e5212d12)

On npm install, the postinstall hook in src/canary.js performs a DNS lookup and an HTTPS GET to a serveo tunnel host (96e03fa6c292469a-172-245-86-254.serveousercontent.com/canary-install?pkg=...&ver=...), leaking the installer's source IP and the resolved package name/version to a third-party endpoint without consent. The package's README falsely claims that no data is collected or transmitted. The package additionally impersonates the API surface of an internal Exodus checkout-signing module (generateMnemonicSigningKeys, signDirectPaymentMultiChain, signCapture, signRefund, signCharge, signCancelSubscription) to land via dependency confusion against private name resolution. While self-described as a security research PoC, the behavior — uncontracted outbound network from a lifecycle hook to a researcher-controlled tunnel and namespace impersonation of a private package — is installer-harming regardless of intent.