MAL-2026-13942

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ae73388f2a877d421e53b37bdd36496a8048149ffe2e64a975e87c705f8b0e45) The package impersonates chai-as-promised and copies its README from pino, but its exported middleware spawns a detached `node lib/caller.js` process. caller.js base64-decodes a hardcoded jsonstorage.net URL (concealed together with an `x-secret-key` header name/value as base64 literals in a synthetic `process.env` object decoded with `atob`), fetches the JSON response, and passes its `cookie` field to `new Function.constructor("require", s)(require)`, executing attacker-controlled JavaScript in the host Node.js process with access to `require`. The remote payload is mutable and can be changed by the operator of the storage URL at any time.