path-internal@1.0.15

Analysis

path-internal@1.0.15 is a combosquat of Node's core 'path' module. The main file path.js is a copy of Node's path module with two malicious insertions: (1) two base64-encoded URLs stored as variables randomStringRe and tokenStringRe, both decoding to jsonkeeper[.]com URLs; (2) a live IIFE at line ~489 that calls fetch(atob(tokenStringRe)), fetches JSON from hxxps://www[.]jsonkeeper[.]com/b/TPQHE, and evals data.content — remote code execution on require(). A second (commented-out) IIFE with the other URL shows iterative development of the same technique. Dependencies include execp, request, axios — none needed for a path utility — and the publisher email [account] is a throwaway. No token-theft markers found; the payload is a RCE dropper that can fetch and eval any JS from the remote host.