dsh-redteam-mode@0.15.2

Summary

Package name and shipped file names (score-rules.js, report-replay.js, store-core.js, tools.js, client.js) describe an offensive-security / red-team mode helper. Pattern matches fire on co-occurrence of curl invocations and HTTP GET/POST calls across several library files, which is expected shape for pentest tooling that constructs example requests, replays reports, and scores rules. No lifecycle script-driven install-time execution, no hardcoded exfiltration endpoint, no credential-store or home-directory secret enumeration, and no obfuscated remote fetch were identified in the evidence. The curl and POST tokens appear as part of library methods callers must explicitly invoke rather than install-time or import-time side effects. Offensive-security libraries are a legitimate category and installing them does not by itself attack the installer; however, the breadth of network/command primitives and the lack of traced-code confirmation of their call sites warrants human review.

Source: amazon-inspector (4b10e8cb5b42b044dde881818592b20e43d2166d6641bd657bf90c2aa5a0c0a2)