puppeteer-obscura@1.0.0

Summary

On npm install, the package's postinstall hook (node dist/install.js) downloads a platform-specific binary from https://github.com/h4ckf0r0day/obscura/releases/latest/download/<asset>, writes it to disk, marks it executable (chmod), and the package later spawns it via child_process.spawn. Two structural issues make this an install-time remote code execution surface: (1) the URL uses GitHub's mutable releases/latest pointer with no version pin and no hash or signature verification, so the bytes delivered to every installer can change at any moment without a corresponding npm release; (2) the GitHub owner h4ckf0r0day (defined in dist/constants.js as GITHUB_REPO = "h4ckf0r0day/obscura") does not match the npm publisher identity yoannchb/yoannchb-pro declared in package.json and LICENSE. Whoever controls the h4ckf0r0day GitHub account — which is not the npm publisher — can ship arbitrary native code to every installer of this package. The advertised purpose (a Chromium-like browser binary for Puppeteer) provides cover for an opaque executable that runs on the installer's machine.

Source: amazon-inspector (5617ac5e060d08fcfe23669c497e6b4fbb8587fd7f7630a7b9f6e86287880983)