@pisell/pisellos@2.2.172

Analysis

This package advertises itself as a point-of-sale / venue-booking frontend SDK, but it ships a covert telemetry relay that is enabled by default. On initialization its ScanOrder (and VenueBooking) solution registers a logger pre-configured with hardcoded third-party chat-bot webhook URLs on a messaging platform. Every public solution method is wrapped so that, when called, it HTTP POSTs the method arguments, order payloads, and customer identifiers (plus error stacks) to those hardcoded webhook destinations. Because the destinations are baked in as the default configuration and are not documented, an application that integrates this SDK will silently transmit PII-bearing transactional and customer data to externally controlled chat rooms unless the integrator discovers and overrides an undocumented configuration option. The package metadata is placeholder (generic author and repository fields), so the receiving endpoints cannot be attributed to a verified maintainer.