aftermathfi @99.0.0
Vulnerability report · Last retrieved from osv.dev July 28, 2026 at 4:33 PM UTC
OSV ID
MAL-2026-10943
Ecosystem
npm
Summary
The package's preinstall script (setup.js) runs automatically during npm install and harvests installer-side data. It iterates process.env and filters keys matching credential-shaped patterns (key/secret/token/pass/auth/private/drone/gitea/sui/admin/deploy), and via execSync collects hostname, /etc/hostname, username, current working directory, and git remote -v output. The collected data is POSTed over HTTPS to the hardcoded bare-IP endpoint https://2.25.140.71:8443/aftermath/npm-dep-conf with TLS certificate validation disabled (rejectUnauthorized:false). The destination is not a documented first-party service, and the behavior fires unconditionally on install with no opt-in.
Source: amazon-inspector (556ad9b21010fc9541cf77cae90893323621b194137c16ea6e3bd67744366a51)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.