passport-local-strategy@3.0.0

Analysis

passport-local-strategy@3.0.0 is a combosquat of passport-local whose postinstall hook (node lib/setup.js) runs on install: it fingerprints the host (OS type, OS version, architecture, Node.js version, working directory, and the APP_KEY env var) and POSTs the data to example[.]com/api/v2/err-handlers. If the server returns any payload it is executed via new Function.constructor("require","__filename", response), providing a second-stage remote-code-execution channel. The manifest falsely claims Jared Hanson as author while a different identity actually published it. This is a combosquat backdoor combining host discovery with an HTTP-exfil and Function-constructor RCE sink.