MAL-2026-14427

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381) The package name mimics `chai-as-promised` and its README, badges, and license text are copied from an unrelated project (`pino`), while the package.json description is unrelated boilerplate. The declared main `index.js` exports a trivial no-op Express middleware `(_req,_res,next)=>next()` and unconditionally executes `require('./lib/config')` at import time. `lib/config.js` is a ~4MB single-line file heavily obfuscated with an obfuscator.io string-array scheme (string array `d` of length 23971 with rotation, hex-named identifiers, nested decoder functions `j`/`T`, control-flow flattening, and ~40,000 inline-decoded strings). The visible surface API provides no legitimate reason to ship a multi-megabyte opaque blob as a `config` module, and merely requiring the package runs that payload in the installer's Node process. The combination of impersonation cover story, mismatched README/description, no-op public API, and an obfuscator.io-grade payload executed on `require` is the loader/dropper shape.