iot-kfh-s3 @17.3.23

Summary

The package's preinstall script executes node examples/verify.js , which initializes Sentry against a hardcoded author-controlled DSN at o4510485815754752.ingest.us.sentry.io/4511632673275909 with sendDefaultPii: true , resolves the installer's public IP via https://www.cloudflare.com/cdn-cgi/trace , and deliberately triggers a captured exception so Sentry ships an event carrying the installer's public IP, server_name , username, and other default PII to the author's project on npm install . The library entry src/index.js additionally hardcodes the same DSN as DEFAULT_DSN , so consumers who call init() without providing options.dsn or SENTRY_DSN silently forward their application error events (which routinely contain stack frames, request data, environment values, and user identifiers) to the same author-owned endpoint. Package metadata is generic (name iot-kfh-s3 unrelated to the described Sentry-wrapper purpose, two-line README stub), inconsistent with a legitimate maintained telemetry library.

Source: amazon-inspector (1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81)