[email protected] exposes a factory function 'createJsonService' under the 'JsonS' key in its public API, which fetches JSON data from https://www.jsonkeeper.com/b/XVHGD, a mutable and author-controlled paste service. It extracts the 'data' property from the response and passes it to the JavaScript Function constructor with 'require' bound, enabling execution of arbitrary code hosted remotely. This design allows an attacker controlling the pastebin content to execute arbitrary code in any process that uses this factory, effectively creating a remote code execution backdoor that is not part of the documented package behavior. The malicious code only executes when the factory is invoked or enumerated, not on install or import.

Any consumer process that invokes or enumerates the 'JsonS' factory in [email protected] is subject to remote code execution controlled by an attacker who can modify the payload hosted on the mutable third-party JSON hosting service. This can lead to full compromise of the affected environment. The malicious code execution is stealthy as it is triggered only on factory invocation and the payload can be changed dynamically without republishing the package.

No official patch or remediation is currently documented. Users should immediately avoid using url-func-registry version 1.0.4, especially any functionality invoking the 'JsonS' factory. Since the malicious payload is hosted externally and mutable, removing or replacing the package is the safest mitigation. Monitor vendor advisories for any official fixes or updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.