z-deno-truth-bwhlsz@2.0.0

Summary

The package's exports field maps the ./package.json subpath to setup.js, so any consumer resolving require('z-deno-truth-bwhlsz/package.json') executes JavaScript instead of reading the manifest. setup.js writes a Deno/Hono handler to /tmp/h.tsx that reads /readflag, /flagserver, /app/backdoor.tsx, and /entrypoint.sh from the host filesystem and returns their contents in the HTTP response, matching on a hitcon{...} pattern. The exports subpath hijack turns routine package-metadata resolution into arbitrary code execution on the installer, and the dropped file is a shipped exfiltration handler intended to be picked up by a Deno server on the host. While the file-read targets are specific to a CTF environment, the delivery mechanism (subpath hijack + filesystem drop) executes on any host that resolves the package's ./package.json subpath.

Source: amazon-inspector (db0813755b79e157c644502848b1ff5af003fc82fb842b39676490d00f33e814)