The fastify-addone package (version 5.1.0) impersonates the legitimate fastify-plugin package by copying its source code but injecting a malicious top-level statement in lib/getPluginName.js. This statement base64-decodes a URL, fetches JSON data from an anonymous third-party JSON hosting service, and executes the 'content' field via eval. This results in arbitrary attacker-controlled JavaScript execution in any process that requires fastify-addone, either directly or indirectly. The payload URL is obfuscated using base64 encoding to evade casual inspection. No patch or remediation information is provided.

Any environment that installs and requires fastify-addone version 5.1.0 is at risk of remote code execution by an attacker controlling the JSON payload. This can lead to full compromise of the host running the Node.js process, including data theft, system manipulation, or further malware deployment. The malicious code executes with the privileges of the Node.js process, posing a critical security risk.

No official patch or remediation is currently documented. Users should immediately remove the fastify-addone package version 5.1.0 from their projects and replace it with the legitimate fastify-plugin package from a trusted source. Avoid installing or requiring fastify-addone. Monitor dependencies for supply chain compromises and verify package authenticity before use. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.