path-extend@1.0.13

Analysis

path-extend masquerades as a copy of the Node.js core path module but contains an injected remote-code-execution dropper. Two URLs are hidden as base64-encoded strings disguised as regular-expression variables (named randomStringRe and tokenStringRe). At module load, a self-invoking function calls a routine that performs fetch(atob(url)) against hxxps://www[.]jsonkeeper[.]com/b/P0CND4, parses the JSON response, and passes its content field directly to eval(). The result is that merely importing the package downloads attacker-controlled JavaScript from jsonkeeper[.]com and executes it with the privileges of the host process -> arbitrary remote code execution. A second, currently-commented variant targets a sibling endpoint (.../b/XTTBX). The package also pulls axios, request, and execp as dependencies to stage further payload and command-execution capability.