MAL-2026-13359

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (44b80ff2bcf35e5c92c1c8a551b943d334f94793d693ce846707986613db8108) src/config.js hardcodes a remote host as the English-word phrase "Four Five P Nine Five P One Eight Six P Two Three Seven" and decodes it at import time via a textToIp() helper to the IPv4 address 45.95.186.237, then exports SOCKET_SERVER_HOST (port 8008) and DJANGO_API_URL (http://45.95.186.237:8000). The word-to-digit encoding serves solely to hide the destination from string and URL scanners. src/constants.js enumerates Chromium, Chrome, Brave, Edge, Opera, and Vivaldi User Data directories under %LOCALAPPDATA%/%APPDATA%, along with Local Storage, leveldb, Local Extension Settings, and Sync Extension Settings paths, the LastPass Chrome extension ID (hdokiejnpimakedhajhdlcegeplioahd), and a KEYLOGGER_DIR ("Results") with a KEYLOGGER_LOG_FILE ("events.log"). The package is the shared configuration layer of a browser-credential-stealer and keylogger toolkit: any consumer importing it inherits the C2 endpoint and the browser-secret target-path list.