MAL-2026-12805

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b9ae02b92920c1e028b5785e69013ea4662e4eb3180872531d64ccca00eef239) The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api.workers.dev?id=2 and then executes `globalThis[data.success](data.id)`, where both the method name and its argument are supplied by the remote server. This gives the operator of that endpoint arbitrary code execution on any machine that runs `npm install strath` — the invocation fires automatically as part of the default install lifecycle. The behavior is unrelated to the package's advertised path-utility purpose. The same script also references `globalThis[tag](text)` with undefined identifiers, consistent with a deliberately opaque dropper shape rather than a normal build step.