mddriver@1.8.6

Analysis

mddriver@1.8.6 is a combosquat posing as a MongoDB driver (its README documents a mongo-driver API). The actual index.js is Node's path module with a malicious block injected: it base64-decodes a URL to jsonkeeper[.]com/b/C4H0M, fetches it via fetch() at require-time, and evaluates the response with the Function constructor. The module re-exports the path API to mask the payload, so the malicious fetch is invisible to a consumer who only uses the exported functions.