syft-acp-util @17.0.0

Summary

package.json declares a preinstall script that runs examples/verify.js. That script calls init() with a hardcoded DEFAULT_DSN pointing at o4510485815754752.ingest.us.sentry.io/4511744089718784 and sendDefaultPii:true, fetches the installer's public IP from Cloudflare's cdn-cgi/trace endpoint, sets it as the Sentry user ip_address, then deliberately triggers a TypeError so an event containing the installer's public IP, hostname, and stack context is uploaded to the author-controlled Sentry project on every npm install . Separately, src/index.js exposes an init() whose dsn resolution falls back to the same hardcoded DEFAULT_DSN when no dsn option or SENTRY_DSN env var is supplied, so consumer applications that call the advertised init() without an explicit DSN will route their captured exceptions and default PII to the author's Sentry project.

Source: amazon-inspector (ce769ca061fa185c98690c83ff80f642ed7eb2e94e4c6ed4a3f6e042065af40f)