---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e81c03febf0e971e3e3442e9e9d7987d297c951f84990ea3bfa68edc8e05e544)
The crate is advertised as a URI canonicalization utility, and lib.rs is pure string manipulation with no network I/O. However, build.rs executes on every `cargo build`/`check`/IDE load and performs installer-side credential theft. It enumerates the full process environment via `env::vars()` with no key filtering, appends hostname and username, serializes the result to a JSON file under OUT_DIR, and POSTs it via a detached `/bin/sh -c "(curl -s -X POST... --data-binary @...)"` on Unix and a hidden `powershell iwr -Method Post` variant on Windows. The three destination URLs are stored as base64 literals and decoded at runtime: `api.sdklfghaljksdhfkjasdfhlasdhfjklasdf.xyz`, `webhook.site/0a60608b-63de-480c-a441-38a8d107a9ea`, and `session-check.sapho11.workers.dev` (the `sapho11` handle matches the crate's Cargo repository field). Reporting is gated by base64-encoded environment-variable markers that select release/publishing workstations — `VINOR_`, `MATCH_`, `FASTLANE_`, `APPLE_ID`, `SPARKLE_`, `ANDROID_KEYSTORE`, `KEYSTORE_`, `PLAY_PUBLISHER`, `SIGNING_CERT`, `CODE_SIGN`, `DEVELOPER_DIR`, `KEYCHAIN` — while suppressing generic CI-runner usernames (runner, root, github, actions, circleci, travis, jenkins, codespace). Env scraping on these hosts routinely captures `CARGO_REGISTRY_TOKEN`, `GITHUB_TOKEN`, `AWS_*`, signing-certificate variables, and keystore paths, enabling downstream code-signing and package-publishing compromise.
The npm package @openyard/vetcode versions 0.3.0 and 0.3.1 contain malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker full control over the system, necessitating immediate rotation of all secrets and keys from a separate, uncompromised device. Simply removing the package does not guarantee removal of all malicious software introduced by it.
The npm package @bestcoolman/dev-mcp contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different machine. Removal of the package alone does not guarantee elimination of the malicious software, as the attacker may have gained full control of the system.
The charape npm package contains malicious code that compromises any computer on which it is installed or run. This compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and must be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package react-bootstrap-table2-toolkit-bg contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package react-bootstrap-table-next-bg contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious components, as the attacker may have gained full control of the system.
The npm package 'file-saver-bg' contains malicious code that fully compromises any computer on which it is installed or running. The compromise allows an attacker to gain full control over the affected system. Immediate rotation of all secrets and keys stored on the compromised computer is advised, using a different, clean machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The archetype-index-sdk npm package contains malicious code that fully compromises any computer on which it is installed or running. Immediate rotation of all secrets and keys stored on the affected computer is strongly advised. Removal of the package is recommended, but it may not eliminate all malicious software due to potential full system compromise.
The npm package 'template-projection-map' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee the elimination of all malicious software introduced by it.
The npm package 'template-pictogram' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.
The npm package 'template-cards' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee the elimination of all malicious software introduced by this package.
The npm package '@aaron205whitmore/postcss-animate-utils' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, secure machine. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
The npm package dsh-ungate version 0.2.3 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The focashi npm package version 1.1.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The malicious subscription targets are obfuscated or dynamically fetched, and the attack leverages the victim's own WhatsApp session. The code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The @liauto/darwin-arm64 npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone may not eliminate all malicious software introduced by its installation.
The @liauto/cli npm package contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package @liauto/linux-x64 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software or restoration of system integrity.
The npm package @liauto/linux-arm64 contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a separate, trusted machine. Removal of the package does not guarantee elimination of all malicious software introduced by it.
The npm package @dikaaofficial/eslint-config contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, uncompromised machine. Simply removing the package does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package @dikaaofficial/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removal of the package alone does not guarantee elimination of the malicious software or control established by the attacker.