z-deno-truth-bwhlsz@1.0.0

No blocking static signals were detected.

Consumer imports z-deno-truth-bwhlsz/package.json.

Can alter an application pages directory and expose host secrets through a planted route.

Deceptive export-time web-handler dropper for local secret harvesting.

The manifest makes the normal-looking package.json subpath execute setup.js. That module writes a TSX handler into /app/pages/h.tsx when permitted; the handler reads flag locations, root/app directory listings, process environment data, and /readflag content, then returns the results in an HTTP response. It also drops the same handler in /tmp.

This is concrete secret-harvesting and application-file mutation hidden behind a deceptive export, despite lacking an install hook or direct network call.