express-plugin@1.6.6

Analysis

The package express-plugin@1.6.6 is a remote code execution downloader. On require(), it fetches JSON from hxxps://jsonkeeper[.]com/b/PRA3O, extracts the "cookie" field from the response, and passes it to the Function constructor to dynamically create and execute arbitrary remote code. The newly-constructed function receives the Node.js `require` module as an argument, giving the C2-controlled payload full access to read the filesystem, environment variables, and installed modules. The package has no declared dependencies and its only file is a stub with stolen code comments from the normalize-path project. The payload hosting URL is jsonkeeper[.]com/b/PRA3O.