@pisell/pisellos

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Host application initializes and uses the ScanOrder solution without overriding logger configuration.

User/order workflow data, including scanned codes and logged errors, is sent to external webhook recipients.

Default hard-coded webhook telemetry exfiltration.

When a host initializes ScanOrder without an explicit logger override, the package sets embedded Feishu webhooks. ScanOrder logs user-supplied scan codes and other operation payloads; the logger serializes payload, context, and extra data and POSTs it to those recipients. The published dist entry contains the same webhook configuration.

This is a concrete, default-enabled runtime data-exfiltration path to hard-coded external recipients, not merely configurable application telemetry. The absence of install hooks does not mitigate the runtime disclosure.