MAL-2026-14257

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/modsync/MAL-2026-14257.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14257
Published
2026-08-19T05:04:38Z
Modified
2026-08-19T05:31:27.680663475Z
Summary
Malicious code in modsync (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494)

The package presents itself as a pino-like logger/middleware (README, docs/, and index.d.ts copied from pinojs/pino; keywords fast/logger/stream/json) but its exported middleware is a no-op. index.js unconditionally requires ./lib/config, which is a 4 MB single-line file bearing obfuscator.io fingerprints (hex-named identifiers, a ~23,909-entry rotating string array, decoder functions, control-flow flattening, hex string escapes) and executes a top-level IIFE at module load. Consumers that require('modsync') execute this obfuscated blob in their process. Package metadata is inconsistent with the advertised purpose (name modsync combined with pino keywords, description referencing vulnerability management, author Robert King <hello@jsonspack.com>, bugs URL jsonspack.com/issues). The combination of a plagiarized cover-story shell around a large obfuscated require-time payload is characteristic of a malicious package rather than legitimate business logic; the obfuscation exists to hide behavior from inspection.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T05:13:50.086026854Z",
            "sha256": "04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494",
            "modified_time": "2026-08-19T05:04:38Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018373",
            "versions": [
                "5.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / modsync

Package

Name
modsync
View open source insights on deps.dev
Purl
pkg:npm/modsync

Affected ranges

Affected versions

5.*
5.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/modsync/MAL-2026-14257.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "8397643af68793d57aec3637e79324e9183d6f1168009cd0676432515e88c515",
            "tlsh": "261652d88984d123d3de9b13fe14a9a8f1fa79a6d4cce40b86987d4d29fc847d4a0cd4",
            "path": "lib/config.js"
        },
        {
            "sha256": "7132bcce7e266aa08c1d8bf541e48542c81df580f26604be51825a401dd9fe48",
            "tlsh": "69019920deb89e2301ed25424c2a0603b6614c17a528fc2933dba12c4fad5ff01ff21d",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "modsync-5.0.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-DUW3j6SrEpBHZm8XiMIEQCVfxC+p9fYkx96tGQV4fT9g/tcFTmpikBnQJVPlw2zQASoTRrdAvgKVU5Z1y7Q+Ag==",
                "sha1": "456d910bc74628687754e05e3c1bfeda3231e8f2"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]