The 'express-router-engine' npm package (versions 3.6.5 to 3.6.8) contains a single obfuscated JavaScript file that executes immediately upon require(). This code constructs a URL from encrypted constants and the package version, then sends an HTTP GET request with an Authentication header to a remote server. The response is parsed to obtain a symmetric key and IV, which are used to decrypt a payload. The decrypted payload is written to a temporary file and executed via child_process.exec with hidden windows. The obfuscation hides all critical strings including module names, URLs, headers, crypto algorithms, and file paths. The package name and description mismatch suggests it is a typosquatting or name-confusion attack to trick users into installing it instead of a legitimate routing helper. This results in arbitrary code execution on any machine that requires this package.

Any system that installs or requires the affected versions of 'express-router-engine' will execute attacker-controlled code, leading to a full compromise of the host environment. The malicious payload is fetched dynamically from a remote server, allowing the attacker to change or update the payload at will. This can lead to data theft, system manipulation, or further malware deployment. There is no indication that this is limited to specific environments or targets.

No official patch or remediation is currently available. Users and organizations should immediately avoid installing or requiring 'express-router-engine' versions 3.6.5, 3.6.6, 3.6.7, and 3.6.8. Remove these versions from existing projects and replace them with trusted, verified packages. Monitor dependency trees for this package and audit for any signs of compromise. Since this is a malicious package, the best mitigation is to avoid its use entirely.