MAL-2026-15555

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023)

On module load, index.js reconstructs a URL from a char-code array that decodes to https://access-token-delta.vercel.app/, fetches a JSON response, and passes the response's token field directly to eval(). Any code the remote host returns executes in the Node.js process that requires this package. The destination is hidden as a numeric array reconstructed via String.fromCharCode, concealing the endpoint from plain-string inspection. The combination of import-time fetch-and-eval against a char-code-obfuscated remote endpoint is a remote-loader pattern with no legitimate use.