MAL-2026-12378

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11) The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the name, description, and CLI do not match. src/index.cjs exports getPlugin(), which issues an HTTPS GET to https://api.avax-test.dev/ext/bc/rpc with TLS verification disabled (rejectUnauthorized: false) and passes the response body to new Function('require', data)(require), executing whatever JavaScript that endpoint returns with full require access. The loader is present only in the CommonJS build; index.mjs and index.d.ts do not declare getPlugin(), hiding the export from typed and ESM consumers. Any consumer that require()s the package and invokes getPlugin() — or downstream code that iterates the exported api object — runs attacker-controlled code delivered from api.avax-test.dev.