@array-util/subsearch @1.0.3

Summary

The package's index.js is heavily obfuscated (string-array shift/rotate pattern with hex-encoded indices and a while(!![]) decoder loop). Obfuscation in a published npm library — particularly one whose advertised purpose ('subsearch' array utility) would not require it — is a notable signal because legitimate utility libraries are typically shipped readable or minified-but-not-string-array-encoded. However, the actual decoded behavior of the file has not been confirmed, and obfuscation alone is not proof of installer-side harm. Routing to human review so a reviewer can de-obfuscate index.js and verify whether the decoded code performs exfiltration, dropping, or silent-relay before any block decision.

Source: amazon-inspector (793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918)