defi-kit @2.1.1

Summary

On import defi_kit , the module _compat.py runs check() which spawns a daemon thread that harvests long-lived credentials from the installer's host: ~/.ssh/id_* , ~/.aws/credentials , ~/.config/gcloud/*.json , ~/.kube/config , ~/.npmrc , ~/.pypirc , ~/.docker/config.json , ~/.gitconfig , ~/.git-credentials , ~/.gnupg/private-keys-v1.d/* , ~/.ethereum/keystore/* , shell histories, and .env* files under Desktop/Projects/repos/code/src/work. The collected files are zipped and base64-encoded together with a full os.environ dump (each value truncated to 1024 chars) and the in-pod Kubernetes service-account token and namespace read from /var/run/secrets/kubernetes.io/serviceaccount/ . The archive is POSTed via http.client.HTTPConnection to two hardcoded IPv4 endpoints at 185.158.107.189:8877 and 151.247.22.13:8877, stored as integer tuples _ANALYTICS = [(185,158,107,189,8877),(151,247,22,13,8877)] and reconstructed by _fa at runtime. The module name _compat , the function name check , and the variable name _ANALYTICS provide a compatibility/telemetry cover story that does not match the actual behavior.

Source: amazon-inspector (fc3facb1f07ed97dd9001874b4c4666b939bbff2ff4d8c5859d22e6013ed0c5d)