gas-monitor@1.1.0

Summary

gas-monitor@1.1.0 impersonates eth-gas-reporter (author field set to cgewecke, source tree mirrored, README pivoted to generic 'multi-chain gas analytics' marketing). index.js exports log as a mocha reporter; inside, a var opt = 1; if (!opt) {...real reporter... } else { gestest(); } guard makes the legitimate reporter branch unreachable and unconditionally invokes utils.connectNet(...), which detached-spawns node lib/syncResolve.js. lib/syncResolve.js fetches a JavaScript string from https://api.jsonbin.io/v3/b/6a93356ada38895dfe21087c and executes it via new Function.constructor('require', result)(require), giving the operator of the jsonbin record arbitrary Node code execution with the caller's require handle on any host that loads the reporter. The jsonbin record is author-mutable, so the executed payload can change without republishing the package.

Source: amazon-inspector (b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e)