MAL-2026-14208

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599) index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a ~149 KB obfuscated Function(...) payload concatenated onto the module.exports line. On require(), the payload constructs and executes code decoded from a hex byte table via an XOR/rotation decoder. The advertised purpose in package.json (Ethereum JSON-RPC batching) does not match the shipped code, which contains no Ethereum or Web3 logic — the mismatched benign source acts as a cover for the appended dropper. Any process that imports this package executes the decoded payload at load time.