type-context@3.2.7

Analysis

type-context@3.2.7 is a trojanized package that executes remote code on import. The main entry point (index.js) spawns a detached background Node.js process running lib/caller.js. That script fetches JavaScript code from hxxps://json[.]extendsclass[.]com/bin/250fca079abb (with header x-secret-key: _) and executes it via the Function constructor, retrying up to 5 times on failure. The fetched payload is fully attacker-controlled, enabling arbitrary remote code execution on any system that requires this package. A secondary URL (hxxps://jsonkeeper[.]com/b/XRFG3) is also embedded in base64-encoded form.