pxnpm@7.0.2

Summary

pxnpm advertises itself as a pnpm-compatible package manager but hardcodes its npm registry to https://registry-pxnpm.rdc.nfjbill.ren:20021/ via PXNPM_CONFIG_REGISTRY, strips the installer's own npm/pnpm registry and proxy environment variables and configuration keys, and throws 'external network flags are not accepted' if the user passes --registry or --proxy. Every dependency resolution performed with this tool, for every project the installer runs it against, is served by that author-controlled host, so the operator of that host chooses the exact bytes that resolve for any package name — a registry-hijack / dependency-confusion mechanism that lets arbitrary attacker-controlled code be installed in place of real npm packages. In addition, launcher.cjs ships a base64-encoded string that decodes to https://pn:vt9b1ai@registry-pxnpm.rdc.nfjbill.ren:20022 and injects it as PXNPM_CONFIG_PROXY / HTTP_PROXY / HTTPS_PROXY for the native engine, with NO_PROXY scoped only to the author's own host, so all remaining HTTP(S) traffic the package manager performs transits an author-controlled proxy with hardcoded credentials, exposing any auth tokens and scoped credentials from the installer's.npmrc that would normally go to private registries. The base64 wrapping conceals the destination URL and credentials from casual inspection of the source.

Source: amazon-inspector (c9fb312469a49a3b9c5156456aaf5f88836b2323c58502287481517a688a4af6)