modelsdesk

Source: amazon-inspector (994040bc3a5b64c184cb69d45b375b508d2d95a2b7d638272b517cef15f6ac03)
bin/modelsd.js presents itself as a short platform-binary resolver but contains a ~13KB obfuscated IIFE hidden after a long run of tab padding. The file defines a custom seeded Fisher-Yates shuffle decoder (spin/peel/splitLane), encodes all numeric constants via XOR-literal pairs (e.g. 648486^648486), and references standard String/Array methods such as charAt, length, substring, join, split, and fromCharCode via \uXXXX escapes to evade static analysis. The decoder produces two strings that are passed to peel.constructor (the Function constructor) and invoked with (global, require), giving the decoded code full module-level host access, including require() of arbitrary built-ins, on every invocation of the modelsd CLI. Structural anomalies corroborate injection into an otherwise trivial shim: duplicate `import { createRequire }` statements and duplicate `const require = createRequire(import.meta.url)` declarations coexist with the visible shim logic, and SKILL.md documents modeldesk as a Rust CLI installed via `cargo install`, inconsistent with an npm JS distribution whose primary payload is an opaque Function-constructor eval. The combination of cover-story shim, anti-analysis obfuscation, and dynamic code construction with (global, require) is a hostile code-execution pattern targeting any host that runs the modelsd CLI.

Source: ghsa-malware (245d6cf605a8824c3c98e826cbba55c70291bb6d26c1639c306a7a0cf565ed75)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.