morglog @1.1.0

Summary

morglog@1.1.0 is published under a name resembling the popular morgan HTTP logger and reuses morgan's description. The tarball ships only LICENSE, README.md, and index.js. index.js requires an undeclared-in-morgan dependency module-relpath and, inside the exported factory, calls modshift('logo.png', morglog, size) — passing the module object and a caller-supplied argument to that opaque helper. Immediately after, index.js executes var logo = require('./public/log') , but ./public/log is not present in the shipped files list, so the require would normally fail unless module-relpath 's prior call materializes or intercepts that module. Consumers who install morglog as a morgan replacement and call app.use(morglog()) therefore load and execute whatever code module-relpath provides in the host Node.js process.

Source: amazon-inspector (d70fd694cbd6fff160cc788117eac2e85e921870f0a2a2e24dbaf81418ed19a1)