-= Per source details. Do not edit below this line.=-
The npm postinstall script in array-sort-helper@1.0.0 automatically runs on npm install and executes a shell reconnaissance and exfiltration routine. postinstall.js collects hostname, user, pwd, uname, container/docker markers, process tree, GitHub Actions CI variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, RUNNER_NAME, CI), local IPs, /etc/resolv.conf, AWS and Tencent cloud instance-metadata (IMDS) probes, and a full dump of process environment variables (filtering only npm_* noise). The collected data is base64-encoded and sent via HTTP GET to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/z?d=<base64>. The package presents itself as an array-sort utility but ships no such functionality; index.js contains unrelated color helper code. The behavior is credential and secret harvesting targeted at CI runners and cloud workloads.
The OpenSSF Package Analysis project identified 'array-sort-helper' @ 1.0.0 (npm) as malicious.
It is considered malicious because:
The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.
1.0.0Exploitability
AV:NAC:LPR:NUI:NScope
S:CImpact
C:HI:HA:H10.0/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H