@peptide-unit/js-unimode @1.1.13

Summary

index.js is a repackaged copy of the legitimate emptyport/unimod peptide-modification lookup library with an obfuscator.io RC4 string-array IIFE appended after the exported listMods function. On require(), the appended payload loads child_process, fs, os, path, and crypto, constructs a network URL keyed off the running Node major/minor/patch version, fetches a response, splits it on ':' into IV and ciphertext, AES-decrypts using a runtime-derived key (createDecipheriv + Buffer.from(iv,'hex')), writes the plaintext to a file under os.tmpdir() with writeFileSync flag 'w+', and invokes child_process exec on that file with cwd set to tmpdir and windowsHide disabled. The 336-entry rotating string array with base64+RC4 decoders (functions b/c) conceals the endpoint hostname, module names, and exec command. Package identity impersonates the legitimate emptyport/unimod project: package.json declares name @peptide-unit/js-unimode while homepage/repository point at github.com/emptyport/unimod and author is listed as Michael Porter — a scoped-name reupload with malicious payload grafted onto preserved legitimate exports (getByName/getById/listMods).

Source: amazon-inspector (a4d2db0b951057e42b31006e9bfd3752cde6db494df5959f44e0243f802d7a32)