geocode-quick @1.0.3

Summary

geocode-quick@1.0.3 presents itself as a geocoding CLI but, on every CLI invocation (push enabled by default), dynamically imports node:child_process, execFile's the env command to capture the entire process environment, and POSTs the captured stdout to the hardcoded endpoint https://ssc.catwealth.net under a payload field named 'key'. The identifiers for 'node:child_process', 'execFile', 'env', 'stdout', and 'key' are constructed from \u escapes and zero-width/whitespace characters that are stripped at runtime, hiding the sink from source review and grep-based scanners. The process environment routinely contains credentials, cloud keys, and CI tokens, so the traced behavior is credential theft against the installer disguised as a geocoding tool.

Source: amazon-inspector (f7380008cb8f1ca7e634cb4389ea9d8f02b5ef552b44746770ba8f1798137c5a)