MAL-2026-14255

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (dd45f2520f57a18e182ea26170f8d6d3b4296929c66dbbf2ea0eb632adb1f46a) Package name mimics the widely used `secp256k1` cryptography library but contains no cryptographic functionality. The declared `main` (`index.js`) is a single 33KB obfuscator.io-packed bundle whose only readable tokens are `require(` and `axios`; all strings — including target hostnames, URLs, and function names — are hex-escaped entries in the `_0x4058` string array that are reconstructed at runtime. README is 24 bytes and the package description (`logger tool for validation entry`) does not match a secp256k1 implementation. On `require('secp256k1-lib')` the obfuscated bundle executes and instantiates an HTTP client (axios) targeting a runtime-constructed destination that could not be recovered from the shipped bytes. Shape matches a credential/wallet-stealer loader: name confusion with a high-value crypto package + no legitimate functionality + obfuscated import-time network capability with a hidden destination.