If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
cs-core-api-phoenix 5.1.0 is a dependency-confusion package: its postinstall script reads the OS user name and hostname and POSTs them to https://nathanaccacio.com/collect on every install. It targets an internal-looking name and collects data from whoever installs it, without consent.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- nathanaccacio[.]com other packages →
URLs
- hxxps://nathanaccacio[.]com/collect other packages →