Malicious code in modsync (npm)

The npm package modsync was identified as malicious by Amazon Inspector and the OpenSSF malicious-packages project. The package presents a deceptive cover story, copying README, documentation, and TypeScript definitions from the legitimate pinojs/pino project and using logger-related keywords (fast, logger, stream, json) to appear legitimate.

However, the exported middleware is a no-op. Instead, index.js unconditionally requires ./lib/config, which is a 4 MB single-line file containing heavily obfuscated code with characteristic obfuscator.io fingerprints: hex-named identifiers, a ~23,909-entry rotating string array, decoder functions, control-flow flattening, and hex string escapes. This obfuscated code executes via a top-level IIFE (immediately-invoked function expression) at module load time.

Any consumer that imports modsync will execute the obfuscated payload in their process. The package metadata is inconsistent with its advertised purpose—the name modsync combined with pino keywords and a description referencing vulnerability management, along with a suspicious bugs URL (jsonspack.com/issues), further indicate malicious intent. The combination of plagiarized documentation, a no-op public API, and a large obfuscated require-time payload is characteristic of a supply chain attack designed to hide malicious behavior from inspection.