Use of software with malware In typst-resume-cli
Description
index.js loads https, http, and child_process at the top of the module and sends host/environment data to a hardcoded AWS Lambda URL at https://oo7fsr4cy32q42bzkpgwhy7asu0hzaod.lambda-url.us-east-1.on.aws. The code reads process.env and branches on process.platform before issuing an https.request to that endpoint. The destination is an attacker-controlled serverless URL unrelated to a Typst or resume tooling publisher, and the collected data (environment variables and host attributes) is credential-grade content leaving the installer's machine.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version |
|---|---|---|
 npm |
Aliases
1. 2.