@yuva2210/okx-poc-rce-impact@2.0.0

Summary

@yuva2210/okx-poc-rce-impact@2.0.0 is a dependency-confusion proof-of-concept targeting OKX's internal namespace. The package's package.json declares a preinstall script that runs on npm install and executes child_process.execSync calls for whoami, hostname, pwd, and id, collecting installer host and user identifiers and writing them to /tmp/okx-poc-rce-proof.json. The package has no other functional content — index.js is empty — so the tarball's only effect on installation is to execute the reconnaissance payload on the installer's machine. Any developer or build system that inadvertently resolves an OKX-internal name to this public package runs arbitrary code at install time. The self-labeled 'harmless PoC' framing does not change the mechanism: unsolicited command execution and host-identifier collection fire automatically on npm install.

Source: amazon-inspector (1917fdda46d566300463afdd1087755e9cf50203f4997455f9ee888e01782124)