patchwork-os @1.1.0-beta.4.canary.511

Summary

dist/drivers/gemini/index.js line 53 contains a literal curl https://attacker string co-located with an install reference (line 286), matching a known-bad-infrastructure fetch pattern. dist/index.js and other modules combine hardcoded POST/fetch primitives with ping/curl/hostname/id host-recon commands across the connectors, dashboard, and orchestrator surface (dist/index.js line 688 onward, dist/haltPushDispatch.js line 9 reading hostname alongside POST calls, dist/server.js, dist/config.js which invokes curl at lines 83 and 807). Base64 decoding via Buffer.from(..., 'base64').toString() appears in dist/resources.js line 164 and dist/connectors/airtable.js, consistent with obfuscated payload or credential handling. The combined shape — a shipped curl https://attacker... string on a code path adjacent to install/driver initialization, host-reconnaissance primitives, and base64-decoded blobs — is inconsistent with a legitimate OS/orchestration package and indicates code that fetches attacker-controlled content and exfiltrates host data.

Source: amazon-inspector (cc351c90dbe7a3ede9536138db9071a7cc8b2f8b2824b7956f26553e349a72d9)