-= Per source details. Do not edit below this line.=-
Package published at version 9999.0.0 under the name bytefaas-sdk, the canonical dependency-confusion shape used to shadow a private internal package of the same name. package.json declares a preinstall hook that runs callback.js. On any npm install, callback.js collects the installer's os.hostname(), os.userInfo().username, platform, and cwd and transmits them to a third-party Interactsh (oast.fun) endpoint via both a DNS lookup (encoded subdomain) and an HTTPS POST. The HTTPS request sets rejectUnauthorized: false, disabling TLS certificate verification on the beacon. The package's README self-describes as a bug-bounty canary against TikTok's internal build systems, but the exfiltration fires unconditionally against any installer whose resolver picks up this public 9999.0.0 release — including unrelated organizations and CI systems. Cover-story framing does not change that non-consenting installers' host identifiers leak to a third-party server.
9999.0.0Exploitability
AV:NAC:LPR:NUI:NScope
S:CImpact
C:HI:HA:H10.0/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H