jsf-utils@1.3.1

Analysis

jsf-utils is a combosquat of the legitimate 'utils' package by jonschlinkert. It replaces the lib/string/pathcase.js utility function with a remote code loader. When the module is required, it fetches a second-stage payload from hxxps://jsonkeeper[.]com/b/BPB86 via axios (with a custom header x-secret-key: _) and executes the returned data via Node.js Function constructor with full require access, allowing arbitrary code execution on the installer's machine. It also spawns a detached child_process to run the fetched payload in the background. The package has no lifecycle hooks but the payload runs on import of the pathcase function, which is exported as a public API method.