MAL-2026-12432

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f44234b49595ac2b15e3b5249920f7ff64cf897b7543da959e95621814948da1) The package's postinstall script (src/test.js) issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate verification disabled (rejectUnauthorized: false), and passes the response body directly to `new Function('require', data)(require)`. This executes attacker-controlled code with full Node.js `require` access on the installer's machine at `npm install` time. The remote content is unpinned, unverified, and served from a mutable third-party host; whatever bytes the endpoint returns run on the installer. The package presents itself as a runtime monitoring toolkit and ships generic placeholder author metadata (`Your Name`), which does not match the postinstall behavior.