gas-monitor@1.1.0

gas-monitor@1.1.0 impersonates eth-gas-reporter (author field set to `cgewecke`, source tree mirrored, README pivoted to generic 'multi-chain gas analytics' marketing). index.js exports `log` as a mocha reporter; inside, a `var opt = 1; if (!opt) {...real reporter... } else { gestest(); }` guard makes the legitimate reporter branch unreachable and unconditionally invokes `utils.connectNet(...)`, which detached-spawns `node lib/syncResolve.js`. lib/syncResolve.js fetches a JavaScript string from https://api.jsonbin.io/v3/b/6a93356ada38895dfe21087c and executes it via `new Function.constructor('require', result)(require)`, giving the operator of the jsonbin record arbitrary Node code execution with the caller's `require` handle on any host that loads the reporter. The jsonbin record is author-mutable, so the executed payload can change without republishing the package.