The eslint-plus npm package (versions 6.0.4 and 6.0.5) includes a postinstall script that spawns a detached Node.js child process running a script which fetches JavaScript code from https://jsonkeeper.com/b/UTUUE. This code is executed dynamically with full privileges using the Function constructor, enabling arbitrary code execution on the installer's machine. The use of detached, stdio-suppressed, and unreferenced child processes hides the activity from the user and allows the malicious code to persist after installation completes. The package also attempts to impersonate legitimate eslint tooling by referencing React Training and including nodemailer source code under a false author name, indicating deliberate obfuscation and malicious intent.

This vulnerability allows an attacker to execute arbitrary code with full Node.js privileges on any system that installs the affected eslint-plus package versions. Because the executed code is fetched from a publicly editable source, the attacker can change the payload at any time, potentially leading to persistent and evolving compromise of the affected systems. The malicious code runs silently and detached from the installation process, making detection difficult.

No official patch or remediation is currently documented. Users should avoid installing eslint-plus versions 6.0.4 and 6.0.5. Since the package fetches and executes code from a public, mutable source, uninstalling the package and removing any installed instances is recommended. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates on remediation.