If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c)
package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's absolute __filename path (which typically embeds the OS username and directory layout), Node.js version, and platform/architecture to a hardcoded Discord webhook at discord.com/api/webhooks/1530599209269465319/. The destination is not caller-configurable, the behavior is undocumented, and the webhook URL literal is split via string concatenation to evade trivial grep for the full endpoint. The package ships no other functionality consistent with its name; the install-time beacon is the sole observable behavior.
Source: ossf-package-analysis (96d7709dc56eae4bfe07031da42425b4a94a169255cd7b3bde0f31f0516e0fb0)
The OpenSSF Package Analysis project identified 'whs4_deu' @ 1.0.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.