MAL-2026-15687

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1917fdda46d566300463afdd1087755e9cf50203f4997455f9ee888e01782124) @yuva2210/okx-poc-rce-impact@2.0.0 is a dependency-confusion proof-of-concept targeting OKX's internal namespace. The package's `package.json` declares a `preinstall` script that runs on `npm install` and executes `child_process.execSync` calls for `whoami`, `hostname`, `pwd`, and `id`, collecting installer host and user identifiers and writing them to `/tmp/okx-poc-rce-proof.json`. The package has no other functional content — `index.js` is empty — so the tarball's only effect on installation is to execute the reconnaissance payload on the installer's machine. Any developer or build system that inadvertently resolves an OKX-internal name to this public package runs arbitrary code at install time. The self-labeled 'harmless PoC' framing does not change the mechanism: unsolicited command execution and host-identifier collection fire automatically on `npm install`.