functions-framework-nodejs @1.0.0

Summary

Package functions-framework-nodejs is a typosquat of Google's @google-cloud/functions-framework . Its package.json declares postinstall: node install.js , and install.js runs execSync("id") on the installer's host, then POSTs the captured Unix user/group identity (with package name, version, and timestamp) to a hardcoded webhook.site collector URL. The advertised library surface (index.js) is a trivial stub exporting only name and version — the package's sole functional effect on install is the identity exfiltration. Package metadata self-labels as "For Security Research" by author "Berserk"; that label does not change the behavior: on npm install , installer-side host identity is sent to a third-party endpoint the installer did not configure.

Source: amazon-inspector (d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa)