greatcall-customers-commandapi @99.0.0

Summary

greatcall-customers-commandapi@99.0.0 is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declares preinstall, install, and postinstall lifecycle scripts all invoking node index.js . On any of the three install hooks, index.js collects host identifiers (os.hostname(), os.userInfo(), homedir, platform, cwd, network interfaces), captures the output of whoami and ls -la via child_process.execSync, and enumerates process.env filtering for credential-shaped keys matching /KEY|SECRET|TOKEN|PASS|AUTH|CRED|PRIVATE|AWS_|AZURE_|GCP_|GITHUB|NPM|DB_|DATABASE|API|WEBHOOK|JENKINS|OCTOPUS|CONNECTION/i, then POSTs the collected payload to a hardcoded webhook at https://test.v3n.my/pwn via https.request. The 99.0.0 version and internal-sounding name are the canonical dependency-confusion shape used to override a private registry package of the same name.

Source: amazon-inspector (a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9)