claims-acct-unlock 25.2.1

Details

claims-acct-unlock 25.2.1 contains only a package.json: its declared entry point index.js is not shipped, so the package cannot be used as a library, and it declares a single dependency, aliased node-acct-utilssss21, that is not fetched from the npm registry but from a tarball URL on GitHub (https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz). The code that runs at install time is therefore not part of the published package, and the publisher has already replaced it once. The tarball runs node index.js as a preinstall script and silently ignores errors. The version served when 25.1.9 was published (sha256 2707f1c7c853cd703495678ade5e3819a98620f5f6b6ca247b962d727b3ff84a) downloads the collector host name from https://raw.githubusercontent.com/GamerD11/ping_test/main/burp_collaborator.txt (at the time of writing 378jcbb9w8ce23y2enf0lhbkqbw2k58u.oastify.com) and does nothing if that file is empty; otherwise it runs whoami and hostname, queries https://ipinfo.io/json for the machine's public IP address, network operator and ASN, and sends those together with the home directory, working directory, platform, architecture and Node.js version in an HTTPS POST to that host with certificate verification disabled. The tarball's own entry point is the same script, so requiring the dependency repeats the beacon. An earlier version of the tarball (sha256 af59a1f75fb309422693a656404504c4ab7c25d31a70bf0c36cf2454dea35f43) sent the same host details without the IP lookup in an HTTP POST to http://yrtew6v4g3w9myixyizv5cvfa6gx4zso.oastify.com/. Impact: any developer or CI machine that installs the package discloses its identity, filesystem layout and public network location to a third party, and the publisher can replace the install-time code with a harmful payload at any moment without publishing a new npm version. Remediation: remove the package, install with --ignore-scripts where possible, reject dependencies resolved from URLs outside the registry, and block oastify.com on build hosts. The same publisher ships the same dependency in dependencykfeg 25.0.3, 25.1.3, 25.1.9 and 25.2.1.