modsync @5.0.2

Summary

The package presents itself as a pino-like logger/middleware (README, docs/, and index.d.ts copied from pinojs/pino; keywords fast/logger/stream/json ) but its exported middleware is a no-op. index.js unconditionally requires ./lib/config , which is a 4 MB single-line file bearing obfuscator.io fingerprints (hex-named identifiers, a ~23,909-entry rotating string array, decoder functions, control-flow flattening, hex string escapes) and executes a top-level IIFE at module load. Consumers that require('modsync') execute this obfuscated blob in their process. Package metadata is inconsistent with the advertised purpose (name modsync combined with pino keywords, description referencing vulnerability management, author Robert King <hello@jsonspack.com> , bugs URL jsonspack.com/issues ). The combination of a plagiarized cover-story shell around a large obfuscated require-time payload is characteristic of a malicious package rather than legitimate business logic; the obfuscation exists to hide behavior from inspection.

Source: amazon-inspector (04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494)