{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/writer.js",
              "sha256": "1ab7958719307e09d349a855f54b59c7e5fe94d2f00b05440e2669b702514c7d",
              "tlsh": "05318bd78245a278f3b06aa10e5fa0d1b186e12521507dd83ffc84c367ab4e04ed4fd6"
            },
            {
              "path": "package.json",
              "sha256": "9b2a5f6bbbfa55f7db60f3e83edf0a71ddf98c5a2830aedcb35af2bd7a9b338e",
              "tlsh": "dc018925ce785da308ec248548290252aa60ed6b584cfd5973d7a32c0f4e5bf68be1ad"
            }
          ],
          "package_integrity": [
            {
              "filename": "react-json-chalk-13.4.4.tgz",
              "hashes": {
                "sha1": "724a5212fe4047aca98aa934b3032af19109a35d",
                "sha512_sri": "sha512-oos+FlJaUor3f0YgPAwsmL5gu2ba8WcmyDcObhNNH250f40/6SznsPt4RF5Uc2NRWKKrLpb3zWkWRyluWtXHzQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "react-json-chalk"
      },
      "versions": [
        "13.4.4"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-004875",
        "import_time": "2026-05-26T09:17:32.746004914Z",
        "modified_time": "2026-05-26T08:46:33Z",
        "sha256": "c3411327be0927b7a726464d2bd9a590ff4ca61bc08e9170e4c0e482dc18dac2",
        "source": "amazon-inspector",
        "versions": [
          "13.4.4"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c3411327be0927b7a726464d2bd9a590ff4ca61bc08e9170e4c0e482dc18dac2)\nOn require(\u0027react-json-chalk\u0027), lib/writer.js executes top-level code that attempts require(\u0027modustack\u0027); if not resolvable, it shells out to `npm install modustack --no-warnings --no-save --no-progress --loglevel silent` and then require()s `../../modustack/pino.js`, executing whatever code the attacker-controlled `modustack` package ships. `modustack` is not declared in this package\u0027s dependencies, so its contents are outside this manifest\u0027s audit surface and can be changed by its publisher at any time. The package is a namespace-confusion lure: package name is `react-json-chalk`, but main `pino.js` is verbatim copied from the `pino` logger, the README is from `zod-to-json-schema`, the package.json description is taken from `inquirer` (\"A collection of common interactive command line user interfaces.\"), and the declared homepage is the real pino project\u0027s site (https://getpino.io). lib/writer.js additionally hides a cover-story error message behind a long String.fromCharCode chain, consistent with deliberate effort to evade casual review. The harmful code path fires automatically at import time on any consumer that requires this package.\n",
  "id": "MAL-2026-4792",
  "modified": "2026-05-26T08:46:33Z",
  "published": "2026-05-26T08:46:33Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/react-json-chalk/v/13.4.4"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in react-json-chalk (npm)"
}