pathfix@3.0.7

Analysis

pathfix@3.0.7 is a remote-code-execution dropper. On require(), it immediately makes an HTTP GET to hxxps://jsonkeeper[.]com/b/MC9ED, parses the response as JSON, and executes the .data field as arbitrary code via new Function('require', code) with the full require() scope injected — giving the remote payload access to the filesystem, child_process, and any installed dependencies. The package pretends to be "Stylus porting of normalize.css" but the actual code has nothing to do with that; it's a thin wrapper around a live payload URL. The dependency on sqlite3 (a heavy native module) causes install failures that conveniently mask the RCE on a broken install. No token-theft markers in the static code, but the second-stage payload fetched at runtime could exfil anything.