If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494)
The package presents itself as a pino-like logger/middleware (README, docs/, and index.d.ts copied from pinojs/pino; keywords `fast/logger/stream/json`) but its exported middleware is a no-op. index.js unconditionally requires `./lib/config`, which is a 4 MB single-line file bearing obfuscator.io fingerprints (hex-named identifiers, a ~23,909-entry rotating string array, decoder functions, control-flow flattening, hex string escapes) and executes a top-level IIFE at module load. Consumers that `require('modsync')` execute this obfuscated blob in their process. Package metadata is inconsistent with the advertised purpose (name `modsync` combined with pino keywords, description referencing vulnerability management, author `Robert King <hello@jsonspack.com>`, bugs URL `jsonspack.com/issues`). The combination of a plagiarized cover-story shell around a large obfuscated require-time payload is characteristic of a malicious package rather than legitimate business logic; the obfuscation exists to hide behavior from inspection.