Malicious code in modsync (npm)

The 'modsync' npm package version 5.0.2 presents itself as a logging middleware similar to pino, copying documentation and keywords to appear legitimate. However, its main module requires a heavily obfuscated 4 MB single-line JavaScript file that executes immediately upon loading. This obfuscated code uses techniques such as control-flow flattening, hex escapes, and a large rotating string array to conceal its true behavior. The package metadata is inconsistent and suspicious, with references unrelated to logging and an author email linked to a suspicious domain. This combination strongly indicates that 'modsync' is a malicious package designed to execute hidden code in consumers' environments.

Any application that requires 'modsync' version 5.0.2 will execute the obfuscated malicious code at module load time, potentially compromising the host environment. The exact malicious actions are not detailed, but the presence of a large obfuscated payload executed immediately suggests a high risk of unauthorized behavior or compromise.

No official patch or remediation is currently available. Users should immediately remove and avoid using 'modsync' version 5.0.2. Verify dependencies to ensure this package is not included transitively. Monitor for updates from the npm registry or security advisories for any official remediation or removal notices.