취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b110466fd12f426709ec7f628f63304d175faddb8094d08e8448388ed3114805)

The package.json declares a postinstall lifecycle hook that performs reconnaissance and exfiltration on every install. The script invokes child_process to capture host identity (whoami) and reads process.env, queries https://api.ipify.org to obtain the installer's public IP, and POSTs the collected data to a subdomain under.oast.fun (an out-of-band application security testing / interaction host commonly used as exfiltration C2). Any developer or CI system running npm install for this package will leak host identity, environment variables, and network identifiers to the attacker-controlled callback. There is no legitimate reason for a forms-embedding library to fingerprint hosts and beacon to an OAST domain at install time.

Source: ossf-package-analysis (5bc706a222ff9fef4872e708bcd99cf286eaf8a11c9908c33ed9776e43d600e6)

The OpenSSF Package Analysis project identified 'collected-forms-embed-js' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.