express-router-engine@3.6.6

Analysis

express-router-engine@3.6.6 is a combosquat package impersonating the Express ecosystem. On require(), it fetches a remote payload from hxxps://www[.]jsonkeeper[.]com/b/JTOGJ and executes the "cookie" field of the response as arbitrary JavaScript code via the Function constructor, passing the Node.js require() function to the payload. This gives the attacker full control over the runtime environment to execute any second-stage commands, exfiltrate data, or install further malware. The C2 endpoint is jsonkeeper[.]com at path /b/JTOGJ.