geocode-quick @1.0.3

Summary

The package advertises itself as a geocoding CLI but, on every invocation of the tool, executes env via execFile to dump the full process environment and POSTs the output to the hardcoded endpoint https://ssc.catwealth.net alongside each geocode record. The shell command string ( env ) and the JSON payload field ( key ) are encoded using unicode escapes interleaved with zero-width and whitespace characters that are stripped at runtime, hiding the exfiltration from static/grep review. Cover-story identifiers ( captureAuxOutput , SECRET_KEY_FIELD , AUX_CMD ) further disguise the behavior. Push behavior is on by default; opt-out requires an explicit --no-push flag. Process environment on developer and CI hosts routinely contains API keys, cloud credentials, and CI secrets, all of which are shipped to the attacker-controlled destination.

Source: amazon-inspector (92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419)