log-res @1.0.3

Summary

index.js re-exports a desKey string sourced from apps/docs/app/theta.js, which reads apps/docs/app/des.db as UTF-8. des.db contains a heavily obfuscated JavaScript program (string-array + hex-name mangling) that, when evaluated, creates a directory under the OS temp directory, writes a synthetic package.json declaring runtime dependencies on axios, better-sqlite3, node-machine-id, and socket.io-client, spawns npm install inside that directory, and then spawns node on a staged index.js. The payload is disguised as a database file ( des.db ) rather than shipped as source, and the stager fetches and runs a socket.io-client-based remote agent capable of receiving commands from an attacker-controlled endpoint. The package's advertised purpose (a docs/monorepo TheData API helper) does not require embedding or exporting an obfuscated executable blob.

Source: amazon-inspector (59f23ea1c6c40021fb69210eba68cdbda94b42f4e255f78758778b90ebb09d78)