modsync

{"modified":"2026-08-19T05:04:38Z","published":"2026-08-19T05:04:38Z","schema_version":"1.7.4","id":"MAL-2026-14257","summary":"Malicious code in modsync (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494)\nThe package presents itself as a pino-like logger/middleware (README, docs/, and index.d.ts copied from pinojs/pino; keywords `fast/logger/stream/json`) but its exported middleware is a no-op. index.js unconditionally requires `./lib/config`, which is a 4 MB single-line file bearing obfuscator.io fingerprints (hex-named identifiers, a ~23,909-entry rotating string array, decoder functions, control-flow flattening, hex string escapes) and executes a top-level IIFE at module load. Consumers that `require('modsync')` execute this obfuscated blob in their process. Package metadata is inconsistent with the advertised purpose (name `modsync` combined with pino keywords, description referencing vulnerability management, author `Robert King <hello@jsonspack.com>`, bugs URL `jsonspack.com/issues`). The combination of a plagiarized cover-story shell around a large obfuscated require-time payload is characteristic of a malicious package rather than legitimate business logic; the obfuscation exists to hide behavior from inspection.\n","affected":[{"package":{"ecosystem":"npm","name":"modsync"},"versions":["5.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/config.js","sha256":"8397643af68793d57aec3637e79324e9183d6f1168009cd0676432515e88c515","tlsh":"261652d88984d123d3de9b13fe14a9a8f1fa79a6d4cce40b86987d4d29fc847d4a0cd4"},{"path":"package.json","sha256":"7132bcce7e266aa08c1d8bf541e48542c81df580f26604be51825a401dd9fe48","tlsh":"69019920deb89e2301ed25424c2a0603b6614c17a528fc2933dba12c4fad5ff01ff21d"}],"package_integrity":[{"filename":"modsync-5.0.2.tgz","hashes":{"sha1":"456d910bc74628687754e05e3c1bfeda3231e8f2","sha512_sri":"sha512-DUW3j6SrEpBHZm8XiMIEQCVfxC+p9fYkx96tGQV4fT9g/tcFTmpikBnQJVPlw2zQASoTRrdAvgKVU5Z1y7Q+Ag=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/modsync/v/5.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018373","import_time":"2026-08-19T05:13:50.086026854Z","modified_time":"2026-08-19T05:04:38Z","sha256":"04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494","source":"amazon-inspector","versions":["5.0.2"]}]}}