@s4yhiitestpoc/r3-https
Advanced tools
Affected versions:
Round-3 sample: install fingerprint plus consuming-project identity and CI markers by name only.
Round-3 sample in a study of npm publish-time scanning and dependency confusion evidence collection.
From postinstall, sends a JSON record over HTTPS to an endpoint operated by the
maintainer: package identity, the consuming project's name and the dependency
range that pulled this package in, npm's own configuration variables, container
and CI markers by name only, host identity, and network interfaces.
It reads no environment variable values, no file contents beyond the consuming
package.json's name/version/dependency range, no credentials and no cloud
metadata. It spawns no shell and writes no files.
Maintainer: s4yhii__ (security researcher). Not intended for production use.
FAQs
security holding package
The npm package @s4yhiitestpoc/r3-https receives a total of 82 weekly downloads. As such, @s4yhiitestpoc/r3-https popularity was classified as not popular.
We found that @s4yhiitestpoc/r3-https demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.
Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
