fastify-addone@5.1.0

Analysis

fastify-addone@5.1.0 is a typosquat of the legitimate fastify-plugin package. On require(), the file lib/getPluginName.js executes a top-level fetch to hxxps://www[.]jsonkeeper[.]com/b/HDXPP, retrieves JSON content, and passes it to eval() — achieving remote code execution on every import. The fetched payload is served from www[.]jsonkeeper[.]com and is fully attacker-controlled, enabling arbitrary code execution in the context of any project that depends on this package.