syft-acp-core @16.0.0

Summary

package.json declares a preinstall hook npm install @sentry/node && node examples/verify.js that fires on every npm install . examples/verify.js resolves the installer's public IP via https://www.cloudflare.com/cdn-cgi/trace, attaches it as ip_address on a Sentry user, and captures a synthetic exception. The event is uploaded to a hardcoded DEFAULT_DSN pointing at Sentry org o4510485815754752.ingest.us.sentry.io/4511744089718784, which the installer did not configure. src/index.js additionally hardcodes the same DEFAULT_DSN as the library's default and forces sendDefaultPii: true, so consumers that call init() without supplying their own DSN or SENTRY_DSN environment variable send their captured errors and PII to the same author-controlled Sentry project instead of their own.

Source: amazon-inspector (46bcb30b019b3455aa12747ac76d9aae4cc307eff76b61075c67c01304bdf625)