Malicious code in workrally (npm)
-= Per source details. Do not edit below this line.=-
dist/index.js imports child_process and runs whoami (observed at multiple call sites), then POSTs the result to a hardcoded remote URL https://workrally.qq.com. This is the classic host-identity exfiltration shape: gather installer-side identity via whoami and ship it to an attacker-controlled destination. The destination is a literal in the bundle (not a default parameter or user-configurable endpoint), and the package's stated purpose does not justify reporting host identity off-machine. Installing or loading this package leaks the installer's username/host to the operator of workrally.qq.com.
왜 이 VPI인가 (설명가능 · 실험적)
VPI 산정 기준
| 영향도(기본값(정보 없음)) | 55.00 |
| 악용 신호(추가 악용신호 없음) | ×1.00 |
| VPI | 55.00 |
VPI 공식 vpi-v1 기준