The security-node package version 1.1.4 includes a dependency declaration pointing to http://pack.nppacks.com/npm/security-node, a non-npm-registry host served over unencrypted HTTP. During npm install, the package manager fetches and installs code from this mutable third-party source without authentication, replacing the official registry contents. This bypasses registry-side scanning and version pinning controls, allowing an attacker with control over the third-party host or network path to deliver arbitrary code to the installer's node_modules directory. The shipped code itself is currently benign, but the core risk lies in the tarball substitution mechanism enabling potential malicious code execution.

An attacker controlling the third-party host or able to intercept HTTP traffic can deliver arbitrary code during package installation, leading to supply chain compromise. This undermines the integrity of the npm package installation process for security-node version 1.1.4, potentially allowing execution of malicious code on the installer's system.

No official patch or fix is currently documented. Users should avoid installing security-node version 1.1.4 due to the insecure dependency declaration. Until a fix or official advisory is available, manually verifying package sources and avoiding packages that fetch code over unauthenticated HTTP is recommended. Patch status is not yet confirmed — check the vendor advisory or npm registry for updates.