registry / modsync / 5.0.2

modsync@5.0.2

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Importing the package loads a 4 MB obfuscated payload. It gathers host metadata, sends it through axios to an encoded endpoint, and includes process-execution primitives.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Runtime import or require of modsync/index.js.

Impact

Unconsented system metadata disclosure and potential remote command execution.

Mechanism

Obfuscated host-data exfiltration and command-execution loader.

Attack narrative

The main entrypoint requires lib/config.js immediately. That file executes top-level obfuscated code, loads OS, filesystem, process-execution, crypto, and axios capabilities, constructs host/OS/username/message/data telemetry, and transmits it to an encoded endpoint. Its runtime routine is invoked during module initialization; this behavior is unrelated to the exported no-op middleware.

Rationale

This is concrete import-time malicious behavior, not a benign logger implementation. The absence of an npm lifecycle hook does not mitigate execution when consumers import the package.

Evidence

package.jsonindex.jslib/config.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14257

Source

OpenSSF Malicious Packages via OSV

The package presents itself as a pino-like logger/middleware (README, docs/, and index.d.ts copied from pinojs/pino; keywords `fast/logger/stream/json`) but its exported middleware is a no-op. index.js unconditionally requires `./lib/config`, which is a 4 MB single-line file bearing obfuscator.io fingerprints (hex-named identifiers, a ~23,909-entry rotating string array, decoder functions, control-flow flattening, hex string escapes) and executes a top-level IIFE at module load. Consumers that `require('modsync')` execute this obfuscated blob in their process. Package metadata is inconsistent with the advertised purpose (name `modsync` combined with pino keywords, description referencing vulnerability management, author `Robert King <hello@jsonspack.com>`, bugs URL `jsonspack.com/issues`). The combination of a plagiarized cover-story shell around a large obfuscated require-time payload is characteristic of a malicious package rather than legitimate business logic; the obfuscation exists to hide behavior from inspection.

modsync@5.0.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code