path-internal@1.0.10

Analysis

This package impersonates the Node.js core path module: package.json points main at path.js, which is a verbatim copy of the upstream Node path implementation with a hidden payload spliced into the middle of the file. As soon as the module is required/imported, a self-invoking function fetches a JSON document from a hardcoded paste-style URL (base64-encoded in the source as the constant randomStringRe, decoding to hxxps://www[.]jsonkeeper[.]com/b/HQVPL), reads its content field, and passes it straight to eval(). This is a remote code loader: the attacker can serve arbitrary JavaScript from that endpoint and have it executed on any machine that imports the package, with no further user interaction. A second hardcoded URL (hxxps://www[.]jsonkeeper[.]com/b/HI4TR) is present for an identical, currently commented-out second-stage loader. The package declares axios, request and execp as dependencies, consistent with downloading and executing further payloads.