cursed-modules@9.0.1

Analysis

This package is a challenge/CTF helper module, but the shape of its code is worth flagging: on import, index.js (and the unreferenced script scripts/setup.cjs, which does the same thing) enumerates the filesystem root, selects the first directory entry whose name is at least four characters and begins with "fl", reads that file, and transmits its contents as the JSON body {"manifest": "<contents>"} using HTTP PUT to path /api/modules/ECT-839201 against ports 3000, 8080, 80, 1337 and 5000, with a 3s timeout and all errors silently ignored. In this version every destination is 127[.]0[.]0[.]1, so the file's contents never leave the machine, and the package contains no external hostnames, IPs or DNS lookups and reads no environment variables, tokens, .npmrc, SSH/AWS credentials or wallet data. The package declares no lifecycle hooks, so nothing runs during installation; the behaviour only triggers when the module is imported. It is published under a high version (9.0.1) on a name whose keywords (ecto-modules, spectral-corsair) match a cluster of high-version stub packages that do run install scripts.