bunnyhijack-test-0x00 @1.0.1

Summary

package.json declares "bin": { "node": "./shim.js" } , which causes npm to place a node executable into node_modules/.bin . Since node_modules/.bin is prepended to PATH during npm lifecycle scripts, any sibling dependency whose install/postinstall invokes node (e.g., esbuild and similar packages with native build steps) will execute shim.js from this package instead of the real Node.js runtime. shim.js demonstrates the hijack by writing a marker file at /tmp/.bunnyhijack-test and printing a banner stating the node command was hijacked via esbuild's postinstall. The package's own description self-identifies as a self-triggering PATH-poisoning proof-of-concept, and the dependency on protoc-gen-grpc-web appears chosen to ensure a sibling lifecycle script invokes node during a normal npm install . The current shim payload is benign (marker file + console output), but the hijack primitive itself runs arbitrary code under the installer's user during install and would execute any future payload shipped in shim.js.

Source: amazon-inspector (652b21307c316c7a3237991fdfb6dc4d43716997a91268f43fe9c9c65a3fd76e)