secdriven

On `npm install`, postinstall.js executes `whoami` via child_process and reads os.hostname(), os.platform(), the working directory, and CI / GITHUB_REPOSITORY environment variables, then transmits them as query-string parameters in an HTTPS GET to a hardcoded interactsh subdomain (`lg5ys3jebfzwk366pilidbmah1nsbszh.oastify.com`) under the path `/google/secdriven/`. A DNS lookup using `whoami` output as a subdomain provides a fallback exfiltration channel. The package description ("Security research canary — Google") and README pointing at a Google CTF internal package.json indicate this is a dependency-confusion payload targeting Google's internal namespace; any installer whose resolver picks up this public name leaks host identity, username, working directory, and CI repository path to the third-party OOB-detection endpoint without consent. Whether published as research or attack, the installer-side effect is the same: unconsented identity-and-environment beacon at install time. ## Source: ossf-package-analysis (bafef125d75ec1f8f8b4d9c19e43da29dc8efccecdab347c19a74d1602433535) The OpenSSF Package Analysis project identified 'secdriven' @ 1.0.8 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.