MAL-2026-6497

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (be17d22b28dc53ea46085190c1f5ff11ae16ce4b80539162d68c2ad2b224158e) chai-as-synced@7.0.9 impersonates the pino logger: it ships pino's README, LICENSE, docs/, index.d.ts and lib/ file layout (proto.js, levels.js, redaction.js, transport.js, worker.js, tools.js, multistream.js) with pino's keywords (`fast`,`logger`,`stream`,`json`), while package.json declares an unrelated name and author (Robert King <hello@jsonspack.com>, bugs URL https://jsonspack.com/issues) and a boilerplate description unrelated to logging. index.js unconditionally executes `require('./lib/config')` at module top level. lib/config.js is not pino's config module; it is a ~4MB single-line obfuscator.io bundle (rotated string array of ~23,868 entries, hex-escaped identifiers, control-flow flattening, nested decoder functions) that auto-runs the moment any consumer imports the package. The package also declares `axios ^1.10.0` as a runtime dependency although the visible wrapper (a no-op express middleware) has no HTTP use, positioning the hidden payload to perform network I/O at import. The combination of deceptive identity, hidden obfuscated payload, import-time auto-execution, and a bundled HTTP client is a covert-code-execution shape inconsistent with any legitimate logging library.