@car_loans/dealerships-approval @7.1.5

Summary

@car_loans/dealerships-approval 7.1.5 self-describes as a 'browserslist config' but ships a heavily obfuscated postinstall dropper. package.json declares "postinstall": "node scripts/postinstall.js"; that script uses a rotating string-array + RC4 decoder plus byte-array-to-String.fromCharCode wrappers to hide every module name, method, and URL fragment. On npm install , the script HTTPS-GETs a remote payload assembled from base64 fragments, RC4-decrypts the response, writes it to disk, chmods 0o755, and spawns it detached with stdio:'ignore' and unref() — attacker-controlled code executed on the installer's machine with no user interaction. Before and after payload execution, it collects os.hostname() , os.userInfo().username , platform, arch, package name/version, and an event tag and POSTs them to a base64-assembled remote host; it also encodes fingerprint data into <hex>.<rand>.<host> subdomain labels and calls dns.resolve4 as a DNS-tunnel side channel intended to bypass HTTP egress filtering. The package additionally exhibits the classic dependency-confusion shape: an unusual underscore scope @car_loans/* , README that labels it an 'Internal package — Platform Engineering Team', and homepage/repository/registry URLs on the non-existent car-loans.io domain instructing consumers to point .npmrc at https://npm.car-loans.io . Any developer at a targeted organization who resolves this name from the public registry receives immediate install-time code execution and host fingerprint exfiltration.

Source: amazon-inspector (326f8f463729022112e04c36fd7a67e785ad8fc37f8e7eec19f60738597bd43d)