If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7)
package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads os.hostname() and CI/GitHub Actions environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID), and sends them as query parameters to a hardcoded webhook.site collector at https://webhook.site/1b840cbf-f1a4-4d79-bf11-f1ef62949110. It also performs a DNS lookup embedding the hostname as a subdomain of your-collab-domain.oastify.com (Burp Collaborator) as an out-of-band exfiltration channel. This is the canonical dependency-confusion reconnaissance beacon shape: identify internal build hosts that mistakenly resolve the package name from the public registry.
Source: ossf-package-analysis (6a0cb104ba7e29ae2e20cb4d191f5a1cb0a74de3a26cc06e9e6369d5bbee94e5)
The OpenSSF Package Analysis project identified 'pp-react-worldready' @ 1.0.0 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.