registry / eslint-config-compact-base / 1.0.0

eslint-config-compact-base@1.0.0

Compact base ESLint configuration

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The exported ESLint configuration performs undisclosed host and environment collection on import. It transmits that data to a remote endpoint.

Static reason

No blocking static signals were detected.

Trigger

Loading the package as an ESLint configuration imports index.js.

Impact

Host identity, username, working directory, and CI or repository context can be disclosed to the remote operator.

Mechanism

The entrypoint collects system and CI metadata, encodes it as a query string, and issues an HTTPS GET request.

Attack narrative

When ESLint loads this configuration, the package entrypoint gathers machine and CI context, including hostname, username, current directory, and repository-related environment data. It then sends the encoded values to a remote AWS API endpoint. This behavior is unrelated to providing lint rules and occurs automatically on import.

AI rationale

The package automatically exfiltrates host and CI metadata from its active configuration entrypoint to an unrelated endpoint. This is concrete malicious data collection rather than configuration behavior.

Evidence

package.jsonindex.js

Network endpoints1

cbrsuo9293.execute-api.us-east-1.amazonaws.com/

OSV advisory

OpenSSF/OSV

Advisory

eslint-config-compact-base@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code