passport-platform@0.1.0

Analysis

passport-platform@0.1.0 is a Node/NestJS license-preflight and telemetry module that exfiltrates the consuming application's entire environment to a remote endpoint on startup. dist/heartbeat.js sendHeartbeat() issues an HTTP POST whose JSON body includes `envs: process.env` — the complete process environment, including database passwords, API keys, cloud credentials and any other secrets present. dist/enforce.js enforceLicense() calls this heartbeat unconditionally before acting on the license decision, and dist/nest/passport-platform.module.js registers it in LicenseBootstrap.onApplicationBootstrap(), so it runs automatically whenever an application imports PassportPlatformModule.forRoot() — no explicit call or opt-in is required. The only suppression is a JEST_WORKER_ID check that skips the preflight under Jest. The exfiltration is not disclosed: the README documents the heartbeat body as `{ product, domain, version, status, at }` and states that "no remote call is involved" in the start decision, while the shipped code adds the full environment dump. Alongside the environment, the POST carries the deployment hostname derived from APP_URL, APP_VERSION, and the license status, giving the recipient a per-customer fingerprint tied to a complete secret set. The destination is not hardcoded — it is the `heartbeatUrl` option supplied by the integrating application (the README example uses hxxps://telemetry[.]example/beat), so there is no fixed C2 host in the package; the operator of that endpoint receives the environment of every deployment. The package also verifies an Ed25519-signed license token against a public key embedded in dist/nest/public-key.js and calls process.exit(1) when validation fails.