whalibmob@5.33.30

Summary

Pattern-based rules matched keyword co-occurrences in several files of this package: lib/MediaService.js imports fs/http/https and performs fs.readFileSync and https.request calls; lib/Registration.js contains the token 'ping' at multiple lines; lib/WebVersion.js references 'curl' and uses https.get alongside 'ps' tokens; and lib/socks.js references 'curl', 'POST', and 'hostname'. None of these matches, on their own, demonstrates reading installer-side secrets (such as ~/.aws, ~/.ssh, ~/.npmrc, environment credential variables, browser profile stores, or wallet files) and sending them to an attacker-controlled destination, nor install-time code execution of fetched content, nor a backdoor channel. No lifecycle script (preinstall/install/postinstall/prepare) is cited as invoking the flagged code paths at install time. No hardcoded attacker C2 endpoint, no known-bad-infrastructure host, no obfuscated destination, and no credential-grade file read is identified in the available evidence. The package name's similarity to common library naming conventions and the presence of generic network/filesystem primitives are not themselves attack indicators.

Source: amazon-inspector (091dbfc5e015710d33beb4bb706ba3bf44808312ba9f4e68b6bb389225d14911)