Vulnerability
Malicious code in janus-ft (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8d7caaba8f20d0f04bcb79ab4046d34bea20b858ed3fc37931c76109b366835f) On `npm install`, the package's postinstall.js script harvests installer-side secrets and ships them to a hardcoded bare-IP C2 endpoint. Specifically, it (1) collects hostname, username, and cwd; (2) iterates process.env and selects keys matching the regex /KEY|SECRET|TOKEN|PRIVATE|MNEMONIC|PASSWORD|RPC|ALCHEMY|INFURA|DATABASE|WALLET/i; (3) reads.env from cwd, parent directories, and the user's home directory; (4) reads ~/.npmrc (leaking npm auth tokens that enable further supply-chain compromise) and ~/.config/ipor-fusion/config.json (targeting users of the IPOR Fusion DeFi protocol); and (5) POSTs the bundled payload to https://193.203.169.109:8443/c/janus-ft with TLS verification disabled (`rejectUnauthorized:false`). The package's main entry (index.js) is `module.exports = {};` — it provides no actual functionality, confirming the package exists solely to execute the credential-harvesting payload at install time. The targeted read of ipor-fusion config plus the blockchain-developer-oriented env keyword list (MNEMONIC, PRIVATE, WALLET, ALCHEMY, INFURA) indicate this is a targeted attack on DeFi/blockchain developers.
No CVSS base score from NVD or GHSA yet. NVD typically scores within 24–72 hours of publication; GHSA usually within a day for OSS-flagged CVEs. Last record update .
For interim severity, fall back on KEV / EXPLOIT signals and the EPSS percentile (lower panel). Re-check this CVE after one cron tick — the score lands automatically when the source publishes.
FIRST.org publishes EPSS daily. Coverage isn't universal — pre-disclosure CVEs and reserved IDs don't carry an EPSS score until at least one exploitation signal lands. Score will appear within 24 hours of the next EPSS pull.
No exploitation, limited impact or prevalence