techportal @4.0.10

Summary

package.json declares a preinstall hook ( node beacon.js ) that fires automatically on npm install . beacon.js reads os.hostname(), os.userInfo().username, and process.cwd(), base32-encodes them, and issues an HTTP GET to a hardcoded bare-IP callback URL http://45.76.249.245/beacon/<token>/techportal/4.0.10, carrying the values in X-Bug-Bounty-Host, X-Bug-Bounty-User, and X-Bug-Bounty-Path headers. If the HTTP beacon fails or times out, the same identifiers are packed as base32-encoded DNS subdomain labels and queried (resolve4/resolve6/resolveTxt) against three hardcoded *.oob.asm5.net collector domains, providing a DNS-tunneling channel that bypasses HTTP egress controls. Destination is not caller-configurable and there is no install-time opt-in. Self-labeling of the beacon as an authorized bug bounty or dual-use tool does not change the data flow: installer host identity leaves the installer's machine on npm install to hardcoded attacker-operated infrastructure.

Source: amazon-inspector (2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3)