MAL-2026-14231
Malicious code in chromecast-webdriver-cli (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (0c858cd5357d77c39366f7bd1cc1985a5d7012d33da45d6dc9667544b54198d6) chromecast-webdriver-cli@1.0.0 runs a postinstall lifecycle script that collects host metadata (os.hostname(), platform, arch, node version, package name, npm lifecycle event) and POSTs it as JSON to the hardcoded host h77svwt7.instances.poc.jchunt.top at /chromecast-webdriver-cli on every `npm install`. The destination is an anonymous subdomain unrelated to the upstream project the package name references (shaka-project/generic-webdriver-server). No opt-in, no first-party publisher relationship, and no functional package code — the beacon fires automatically and transmits installer-identifying data to a third-party endpoint. The package name reproduces a legitimate-sounding upstream tool, which is the fingerprint of a dependency-confusion / typosquat beacon.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for chromecast-webdriver-cli (npm). Pin to a known-safe version or switch to an alternative.