{"items":[{"id":"NVI-00010454","kind":"supply_chain_event","title":"Malicious code in exodus-firestore-synchronize (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-m497-v5g4-6c4q"],"plain_summary":"GitHub lists this malware advisory for exodus-firestore-synchronize. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-de47e75c5761f5372212dfc38d1ad67a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-de47e75c5761f5372212dfc38d1ad67a","url":"https://github.com/advisories/GHSA-m497-v5g4-6c4q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-m497-v5g4-6c4q","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:53.250Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-de47e75c5761f5372212dfc38d1ad67a"],"technology":"exodus-firestore-synchronize","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (210b71fe2403143719408cea9a34626d7788c9aaa87b3f5a1276a92bd5578ce6)\npackage.json declares a postinstall hook that auto-runs on `npm install` and executes `whoami` and `hostname`, then enumerates `process.env` for keys matching /TOKEN|SECRET|KEY|AUTH|npm/i and prints the matches to stdout. The package name and description impersonate an internal 'Exodus Wallet SDK' and self-identify as a dependency-confusion demonstrator published to the public registry to intercept installers that misroute an internal package name to this public one. No outbound network sink is present in this version, so the enumerated environment values and host identifiers are written only to the install log rather than transmitted; however, on CI systems those install logs are frequently captured, archived, or exposed, and the enumeration itself targets credential-shaped environment variables.\n\n---\n\nCredit: OpenSSF (source)","public_affected_ranges":["= 0.0.1"]}],"null_published_at":"2026-10-31T22:27:06.718Z","source_updated_at":"2026-10-11T18:30:24.000Z","source_disclosed_at":"2026-10-11T18:30:23.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:06:53.250Z"}],"next_cursor":null,"snapshot_revision":"42594"}