취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9f1d266fef23fc79d6af52affefa68c2220baad023d09a7acc4d439a23dfdb69)

The package's postinstall script executes shell reconnaissance (id || ver && whoami && hostname), fetches the installer's public IP from api.ipify.org, collects USERDOMAIN/COMPANY environment variables, hostname, and cwd, then POSTs the aggregated JSON to an attacker-controlled Project Discovery Interactsh subdomain at yihpvsviuggxabauqtuedjfyzjlrtkpzx.oast.fun. The exfiltrated payload self-identifies as package_name:'audit-logs' while the published name is audit-logsss (triple-s), confirming the package is a deliberate typosquat of the legitimate audit-logs package designed to profile any developer who fat-fingers the install command. The beacon fires automatically on npm install without user consent.