solidity-hold @2.0.1

Summary

The npm package solidity-hold@2.0.1 impersonates the popular pino logger: the README badges and lib/ source tree are copied from pino (pinojs/pino), but lib/config.js is replaced with a ~4 MB obfuscator.io-obfuscated bundle (hex string-array, rotating while(!![]) decoder IIFE, control-flow flattening, ~23,890-entry string array). index.js requires('./lib/config') at top level, so this opaque payload executes on any require('solidity-hold'). The advertised middleware export is a no-op stub, and the package declares an axios dependency (network egress capability) that a logger does not need. Publisher metadata (author Jackson Blau <hello@jsonspack.com>, bugs URL jsonspack.com/issues) is unrelated to the pino project whose code and branding are copied. Heavy control-flow obfuscation of an auto-executing module inside a package that impersonates a widely used dependency is a payload-carrier shape hostile to any installer that requires the module.

Source: amazon-inspector (39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f)