Malicious code in @aiwfm/communitywfm.scripts.api (npm)

Source: amazon-inspector 405cd17e3c682b1341db44361500ea68d80e1758f15387d9971d0af95f0c8a48 The package's preinstall script build.js assembles a remote hostname from split string fragments that resolve to dawn-salad-18c7.mikhail-nab.workers.dev, base64-encodes the full process.env, and POSTs it to...

MSC-2026-6444

Install-time system recon. package.json postinstall runs build.js, which compiles src/monitoring.c and loads it. monitoring.c declares attributeconstructor monitoringconstructor calling initmonitoring, which runs popen"/usr/bin/id" and writes the captured uid/gid/group list to /tmp/monitoring.log...