js-shared-modules@1.11.7

Summary

package.json declares "postinstall": "node poc.js", which fires automatically on every npm install. poc.js reads os.hostname(), hex-encodes it, and issues an HTTPS GET to zcpesvvighyuzqlzkqgdydwp9jn54hfeg.oast.fun (an Interactsh out-of-band callback host), exfiltrating the installer's hostname to a third-party canary. The package has no legitimate functionality — index.js is an empty module.exports = {} and the source banner self-identifies as a dependency-confusion proof-of-concept squatting a generic internal-style name (js-shared-modules) to shadow a private package. Any installer who resolves this public package leaks their host identity to the canary domain.

Source: amazon-inspector (b5d28882e3ff8afe78db631ca5e1129d2b08f976f17f66ffe2b14834184ce09a)