node-path-utils@1.23.2

Analysis

On require(), the package fetches JSON from jsonkeeper[.]com (a public pastebin-like service) and evals the response content, giving the attacker full remote code execution on any machine that installs this package. The package impersonates Node's built-in path module (name "node-path-utils", description "exact copy of the NodeJS path module") but contains a hidden IIFE in path.js that calls loadTokenData(), which base64-decodes the URL aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9QMENORA== (jsonkeeper[.]com/b/P0CND), fetches the JSON content field, and passes it to eval(). A second URL (jsonkeeper[.]com/b/XTXBX) is present but commented out. The publisher uses a ProtonMail throwaway address ([account]), the package was published once as version 1.23.2 with no history, and it bundles unnecessary dependencies (axios, mddriver) that are irrelevant to path utilities — all indicators of a combosquat supply-chain attack delivering dynamic second-stage payloads.