Home
Docs
GitHub
Pricing
Blog
Log In

Run Sandworm Audit for your App

Get started
โš ๏ธ This package seems to have critical severity install script vulnerabilities

Affected script: "install-scripts:preinstall"

The provided code gathers a lot of information which might be considered sensitive and sends it to a remote server. It collects the following data, which is sent over a secure https connection to the server at the hostname "qpjw7bvg5ov51rua11o4fv7lnct3ht5i.oastify.com":

  1. __dirname: The directory name of the current module. This provides the file system path of the module file, exposing local resources information.

  2. os.homedir(): Returns the home directory of the current user.

  3. os.hostname(): Returns the hostname of the operating system, exposing network information.

  4. os.userInfo().username: Returns info about the currently effective user, providing potential personal information.

  5. dns.getServers(): Returns an array of the IP addresses of the servers, potentially exposing critical network configuration.

  6. packageJSON: The package.json file usually contains information about the application and its dependencies, which may expose potential softpoints for attack in any of the dependent packages.

With this information, an attacker could gain detailed insights into the user's local computer structure and system, potentially leading to further exploitation. This information should not be sent to any server without explicit and informed permission from the user.

Generated on Oct 7, 2023 via pnpm

f0-validator 5.0.8

Package summary
Share
0
issues
0
licenses
Package created
9 Oct 2023
Version published
5 Oct 2023
Maintainers
0
Total deps
0
Direct deps
0
License
ISC

Issues

0
This package has no issues

All Versions