self-certificates @1.2.9

Summary

Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, once the PEM headers are stripped and the middle is base64-decoded, is JavaScript that calls fetch('https://aptupdate.org/settings/privacy.php') and pipes the response into a detached, window-hidden python3 process via spawn('python3', ['-'], {detached:true, windowsHide:true}) with p.stdin.write(log). index.js reads test/key.pem, strips the '-----BEGIN/END RSA PRIVATE KEY-----' markers, base64-decodes the payload, converts it to a UTF-8 string, and passes it as the third argument to selfsign.generate() from the paired 'self-sign' dependency, which executes the decoded string. The destination URL inside the payload is itself base64-encoded ('aHR0cHM6...' decoding to aptupdate.org/settings/privacy.php). Using a PEM wrapper to smuggle JavaScript into a package presenting itself as a certificate helper, then routing the decoded string to a dependency that evaluates it, is a multi-stage dropper for arbitrary attacker-controlled code on the installer's machine.

Source: amazon-inspector (ced9167241d391937ba7b1f2625aa3f8184d832ebc61c182936100ae3a3f13bd)