MAL-2026-14223

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6) index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contains a ~65KB obfuscator.io-style block (base64 string array plus an RC4/XOR decoder function A(L,q), with self-defense regexes designed to break under beautification/debugging) sitting at module top level directly above the small plain math exports. There are no lifecycle scripts; the payload executes on any require/import of the package. The header comment steers consumers to install a companion package (svelte-insight-hydration / svelte-insight-tracker) rather than this one directly, framing streak-key-lib as an internal helper meant to arrive transitively — a lure pattern that places hidden import-time code into parent applications' Node processes. The file header name (streak-larq-hydration) does not match the package name, indicating a rename from a template. The mismatch between the stated purpose (pure math, no I/O) and the shipped contents (large encrypted top-level blob with an RC4 string decoder) is the standard shape of a supply-chain stager: benign-looking surface code alongside hidden import-time execution of decoded strings.