gas-monitor @1.1.0

Summary

gas-monitor@1.1.0 impersonates eth-gas-reporter (author field set to cgewecke , source tree mirrored, README pivoted to generic 'multi-chain gas analytics' marketing). index.js exports log as a mocha reporter; inside, a var opt = 1; if (!opt) {...real reporter... } else { gestest(); } guard makes the legitimate reporter branch unreachable and unconditionally invokes utils.connectNet(...) , which detached-spawns node lib/syncResolve.js . lib/syncResolve.js fetches a JavaScript string from https://api.jsonbin.io/v3/b/6a93356ada38895dfe21087c and executes it via new Function.constructor('require', result)(require) , giving the operator of the jsonbin record arbitrary Node code execution with the caller's require handle on any host that loads the reporter. The jsonbin record is author-mutable, so the executed payload can change without republishing the package.

Source: amazon-inspector (b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e)