date-fns-sync @1.0.0

Summary

package.json declares scripts.postinstall = 'node index.js'. index.js reconstructs a URL from a String.fromCharCode integer array — decoding to https://kongregate-api-config.vercel.app/ — fetches JSON from that endpoint, and passes the returned 'token' field directly to eval(). This executes attacker-controlled JavaScript on the installer's machine at npm install time. The destination is not a package publisher domain, the fetched payload is opaque and mutable, and the URL is deliberately concealed via char-code assembly to evade static analysis. The package's README describes it as a caching module, which does not match the observed behavior.

Source: amazon-inspector (8de9cc36a8817e94d67a46762e62e00a58e17077691ea1b4f649bc1f0d49e967)