MAL-2026-13880

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2044da43e53933094b69c1436146bdea64cbc4c011e4b8a141ceea0cab19eb5c) On `npm install`, the preinstall hook (scripts/check-env.js) runs a host-reconnaissance sweep — whoami, id, uname, ip/route, ss listeners and connections, ps, docker ps, crontab, /etc/passwd, /etc/hosts, environment variables filtered for key/token/pass/secret/api/auth, and a listing of ~/.ssh/ — and POSTs the collected data via curl to a hardcoded webhook.site bucket at https://webhook.site/0c5803fc-bdd6-4dd0-8c57-68ee0cabac29/the analysis. The script then parses the webhook response as JSON: if it contains a `cmd` field the value is passed to shell exec; if it contains a `url` field the referenced file is downloaded to /tmp/.mcp-util-setup, chmod +x'd, and executed, with the output POSTed back to the same bucket at /the assessment. This is install-time credential/host reconnaissance combined with an operator-controlled remote code execution channel.