autotel-terminal @35.0.0

Summary

The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base64').toString(...)) co-occur with network primitives (multiple POST call sites) and a 'ping' string in the same file. The individual primitives are consistent with a variety of legitimate CLI behaviors (HTTP client, telemetry, readiness probes, encoded configuration decoding) and are not, on their own, evidence of exfiltration or remote code execution. No specific installer-side secret read (env scraping, ~/.aws, ~/.ssh, ~/.npmrc, browser profile, wallet store) is tied to a specific attacker-controlled destination in the observed evidence, no lifecycle script (preinstall/install/postinstall) is shown invoking the flagged code, and no hardcoded non-first-party C2 host is named. The bundled/minified form limits inspectability and warrants human review before trusting the CLI, but the traced evidence does not establish an installer-side attacker benefit.

Source: amazon-inspector (49899c545b0d4535885123c5d0bd0ba8804da194fc196e950fbf813518ff08a8)