tostpro@112.5.9

Summary

Package tostpro@99.101.0 declares scripts.preinstall='sh./rce_poc.sh'. On install, the shipped shell script runs id/hostname/pwd and appends a timestamped line to./RCE_POC_MARKER.txt in the installer's working directory. The script performs no network I/O, reads no credentials or environment, writes nothing outside the install tree, and installs no persistence. The declared main entry dist/index.js is not shipped in the tarball, so the package has no library/import-time behavior; the preinstall marker write is its only effect. The README identifies the package as a security-research canary demonstrating dependency-confusion exposure for an internal name, consistent with the implausibly high version (99.101.0) used to win resolution against an internal package. The preinstall execution path is a real supply-chain concern in principle because a future version could replace the benign marker with a hostile payload, but this version's shipped payload produces no attacker benefit and no destructive action against the installer.

Source: amazon-inspector (7785c0ac37ad4bb74abc644be2a5fc48bdb0d1248027e607fdf13ddaaa59d546)