{"id":"MAL-2026-14257","summary":"Malicious code in modsync (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494)\nThe package presents itself as a pino-like logger/middleware (README, docs/, and index.d.ts copied from pinojs/pino; keywords `fast/logger/stream/json`) but its exported middleware is a no-op. index.js unconditionally requires `./lib/config`, which is a 4 MB single-line file bearing obfuscator.io fingerprints (hex-named identifiers, a ~23,909-entry rotating string array, decoder functions, control-flow flattening, hex string escapes) and executes a top-level IIFE at module load. Consumers that `require('modsync')` execute this obfuscated blob in their process. Package metadata is inconsistent with the advertised purpose (name `modsync` combined with pino keywords, description referencing vulnerability management, author `Robert King \u003chello@jsonspack.com\u003e`, bugs URL `jsonspack.com/issues`). The combination of a plagiarized cover-story shell around a large obfuscated require-time payload is characteristic of a malicious package rather than legitimate business logic; the obfuscation exists to hide behavior from inspection.\n","modified":"2026-08-19T05:31:27.680663475Z","published":"2026-08-19T05:04:38Z","database_specific":{"malicious-packages-origins":[{"sha256":"04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494","source":"amazon-inspector","versions":["5.0.2"],"id":"IN-MAL-2026-018373","import_time":"2026-08-19T05:13:50.086026854Z","modified_time":"2026-08-19T05:04:38Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/modsync/v/5.0.2"}],"affected":[{"package":{"name":"modsync","ecosystem":"npm","purl":"pkg:npm/modsync"},"versions":["5.0.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/modsync/MAL-2026-14257.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"8397643af68793d57aec3637e79324e9183d6f1168009cd0676432515e88c515","tlsh":"261652d88984d123d3de9b13fe14a9a8f1fa79a6d4cce40b86987d4d29fc847d4a0cd4","path":"lib/config.js"},{"tlsh":"69019920deb89e2301ed25424c2a0603b6614c17a528fc2933dba12c4fad5ff01ff21d","path":"package.json","sha256":"7132bcce7e266aa08c1d8bf541e48542c81df580f26604be51825a401dd9fe48"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-DUW3j6SrEpBHZm8XiMIEQCVfxC+p9fYkx96tGQV4fT9g/tcFTmpikBnQJVPlw2zQASoTRrdAvgKVU5Z1y7Q+Ag==","sha1":"456d910bc74628687754e05e3c1bfeda3231e8f2"},"filename":"modsync-5.0.2.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}