path-addon@1.0.7

Analysis

path-addon is a typosquat of the Node.js core path module: its README claims to be an exact copy and the file body is the genuine Joyent path implementation, used as cover. Appended to the end of path.js is a remote-code-execution dropper that runs at module load time. On require(), it calls fetch() against a base64-encoded URL that decodes to hxxps://www[.]jsonkeeper[.]com/b/RFW6I, an anonymous and mutable JSON paste host, parses the JSON response, takes its content field, and passes it straight to eval(). There is no integrity check, version pinning, or signature, so any process that imports the package executes whatever JavaScript the operator has placed at that URL at that moment. Commented-out additional eval lines (content.one, content.two) indicate multi-payload capability. The fetch URL is base64-encoded specifically to evade casual review and string-matching scanners.