krdpass-auth-react-native@10.0.0

Summary

package.json declares a preinstall script (preinstall.js) that runs automatically on npm install. The script collects os.hostname(), os.userInfo(), homedir, internal IP addresses, CI/repository identifiers (GITHUB_REPOSITORY, CI_PROJECT_PATH, JENKINS_URL, etc.), parent package.json metadata, and enumerates process.env keys matching /(TOKEN|KEY|SECRET|PASS|AUTH|CRED|AWS|AZURE|GCP|NPM|GITHUB|GITLAB|API)/i, then POSTs the payload to a hardcoded anonymous collector at https://webhook.site/5ba4d4a7-b977-4bb8-b26e-517b46271316. Bulk env-name enumeration and internal-network / CI-identifier collection are outside any documented purpose of a React Native auth library and disclose to a remote party which credentials exist on the installer or CI runner and how the host is situated. The manifest additionally lists the package's own name (krdpass-auth-react-native ^1.6.0) as one of its dependencies, causing npm to resolve and execute the lifecycle hooks of future self-published versions during install.

Source: amazon-inspector (3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f)