MAL-2026-14257

Dashboard / Malicious Package / MAL-2026-14257

MAL-2026-14257

Summary: Malicious code in modsync (npm)

Details: Source: amazon-inspector (04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494) The package presents itself as a pino-like logger/middleware (README, docs/, and index.d.ts copied from pinojs/pino; keywords `fast/logger/stream/json`) but its exported middleware is a no-op. index.js unconditionally requires `./lib/config`, which is a 4 MB single-line file bearing obfuscator.io fingerprints (hex-named identifiers, a ~23,909-entry rotating string array, decoder functions, control-flow flattening, hex string escapes) and executes a top-level IIFE at module load. Consumers that `require('modsync')` execute this obfuscated blob in their process. Package metadata is inconsistent with the advertised purpose (name `modsync` combined with pino keywords, description referencing vulnerability management, author `Robert King <[email protected]>`, bugs URL `jsonspack.com/issues`). The combination of a plagiarized cover-story shell around a large obfuscated require-time payload is characteristic of a malicious package rather than legitimate business logic; the obfuscation exists to hide behavior from inspection.

References: https://www.npmjs.com/package/modsync/v/5.0.2