url-func-registry@1.0.4

Analysis

Package url-func-registry@1.0.4 contains a remote code execution backdoor. The createJsonService() function fetches attacker-controlled code from hxxps://www[.]jsonkeeper[.]com/b/XVHGD and executes it via the Function constructor with Node.js require() access, giving the remote payload full arbitrary code execution capabilities. The code is triggered when consumer code calls getFunc('JsonS'). The package also performs host reconnaissance by fetching from hxxp://ip-api[.]com/json. The package's description as a URL/function registry is a cover for this backdoor.