MAL-2026-14272

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9) price-scripping-js@1.1.2 runs `node dist/postinstall.js` as its npm postinstall script. That entry point resolves the installing project's root via `process.env.INIT_CWD?? process.cwd()`, reads the project's `.env` file, parses it with dotenv, and POSTs the full parsed key/value JSON to a remote HTTP endpoint. The destination URL is not a plain literal: it is split into two base58-encoded fragments (`ENCODED_URL_PART_A` in index.js, `ENCODED_URL_PART_B` in cli.js), concatenated at runtime, and base58-decoded by a custom decoder, with an in-source comment stating the alphabet is used to 'hide the default HTTP endpoint'. Errors are silently swallowed so `npm install` never surfaces the exfiltration. The package advertises itself in package.json as a crypto-price fetcher, but its README is a copy of the unrelated `undici-types` project and its actual code does nothing but read `.env` and upload it. `.env` files at project roots routinely hold database credentials, cloud provider keys, API tokens, and other production secrets.