ably-bulk-subscriber@1.0.1

One or more suspicious static signals were detected.

npm postinstall

Exposes DEMO_ABLY_KEY to install logs and /tmp/dependency-confusion-proof.txt.

environment-secret harvesting and local disclosure

Installing the package invokes node poc.js through postinstall. The script reads DEMO_ABLY_KEY, prints the value to stdout, and writes it to a predictable /tmp file. This is concrete automatic credential exposure during installation, even though the script calls itself a proof of concept.

The package contains an automatic install hook with concrete secret disclosure and filesystem persistence. The absence of network code does not remove the install-time credential-harvesting behavior.