MAL-2026-14257 Malicious code in modsync (npm)

The package presents itself as a pino-like logger/middleware (README, docs/, and index.d.ts copied from pinojs/pino; keywords fast/logger/stream/json) but its exported middleware is a no-op. index.js unconditionally requires ./lib/config, which is a 4 MB single-line file bearing obfuscator.io fingerprints (hex-named identifiers, a ~23,909-entry rotating string array, decoder functions, control-flow flattening, hex string escapes) and executes a top-level IIFE at module load. Consumers that require('modsync') execute this obfuscated blob in their process. Package metadata is inconsistent with the advertised purpose (name modsync combined with pino keywords, description referencing vulnerability management, author Robert King <[email protected]>, bugs URL jsonspack.com/issues). The combination of a plagiarized cover-story shell around a large obfuscated require-time payload is characteristic of a malicious package rather than legitimate business logic; the obfuscation exists to hide behavior from inspection.