If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (74d38dada8ec3921b4a3f69e7d44b5f5b54d345ff8f9581d34007a3e68679da4)
package.json declares a preinstall lifecycle script that runs on `npm install` and issues a wget request to https://webhook.site/ea0ca859-424d-4cc5-9210-62f7e25692a1/ carrying the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as querystring parameters. The destination is a third-party request-inspection collector hardcoded in the manifest, unrelated to any documented package purpose. This is the canonical dependency-confusion / reconnaissance beacon shape: automatic execution at install time, unconditional outbound network to an attacker-controlled endpoint, and disclosure of installer host identifiers that identify internal environments and users.
Source: ossf-package-analysis (a0c8bd63b24097ddfa37be2a0c26450b21d7963a77c5bd81bc4892b89490d51b)
The OpenSSF Package Analysis project identified 'vishal_312pkg' @ 1.0.0 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.