@mrbenty8jf1p9y5/oidc-bind-canary @0.0.3

Summary

The package's postinstall lifecycle script issues an HTTPS request from the installer's machine to a Cloudflare tunnel at wiki-shared-carlos-exempt.trycloudflare.com on path /token-capture. The request is sent with the Host header spoofed to dependabot-api.githubapp.com and with TLS certificate validation disabled (rejectUnauthorized:false), disguising the callout as legitimate GitHub Dependabot traffic. The destination path name (/token-capture) and the disguise mechanics indicate an install-time beacon to an attacker-controlled listener, firing automatically on npm install.

Source: amazon-inspector (1a9ed4acf296e53ad5955f759a0f0692d641781b1bd4e67ada1c116216f96fc3)