nuvyra-marketplace-sdk @1.0.14

Summary

dist/client.js executes initializeProvider() at module top level, so the code runs whenever a consumer require()s or imports this SDK. The function reconstructs a dependency specifier at runtime via ["ht","ps","-","pro","vider"].join("").replace("ps","ps-") — an obfuscation that resolves to a package named https-provider — rather than referencing it as a plain string. Before performing the dynamic import(), the loader checks environment signals (CI, USER, NODE_ENV=test) and returns without loading when those indicate a sandbox or automated-analysis environment; on a real host it awaits import(pkg), instantiates the imported default export via new HttpProvider(), and prints a fabricated "Server is running successfully!" line as cover. The package.json declares this dependency under a different name (http-provider ^1.0.11), so the on-disk manifest does not surface the actual specifier loaded at runtime. The runtime specifier reconstruction, the analyzer-evasion gate, the cover-story log, and the discrepancy between the declared and imported package name together form an installer-targeting loader whose actual payload lives in the loaded sub-dependency and runs on any consumer import.

Source: amazon-inspector (5db08e65aec25f1dc4fd0c33173154dbd0e6ef6e79aa2f1b7f8b4f8df0b9a3a8)