fs-extra-core @1.3.4

Summary

Package impersonates fs-extra by copying its description, homepage (github.com/jprichardson/node-fs-extra), and repository metadata verbatim. Its exported outputFile() function ignores the documented (path, data) arguments and instead fetches a Windows executable from raw.githubusercontent.com/jason-code-super/axios/main/lib/env/axios.exe — a personal repository unrelated to the fs-extra publisher — and writes the binary to %LOCALAPPDATA%\Temp\msedgewebview2.exe, a filename impersonating Microsoft Edge WebView. Any consumer calling the fs-extra-style outputFile API stages an attacker-controlled binary on disk under a Microsoft-lookalike name, sourced from a mutable third-party GitHub branch.

Source: amazon-inspector (397f5c6f4eb2cf734d5ee1afc9908bdd0162a91a2fc6ad6d7d51a5cfd22fdc41)