[email protected] is a malicious npm package that masquerades as an SVG utility but exports only an undocumented function getPlugin. When invoked, this function performs an HTTP GET request to a mutable anonymous paste host (https://www.jsonkeeper.com/b/3P9BF), parses the JSON response, and executes the 'model' field content via eval. This design allows an attacker controlling the paste to run arbitrary JavaScript code in any environment that loads and calls this package's export. The package also requires 'request' without declaring it as a dependency, further indicating malicious intent. There is no evidence of official remediation or patch availability.

This vulnerability enables remote code execution in any environment that installs [email protected] and invokes its exported function. Because the malicious code fetches and evaluates attacker-controlled scripts dynamically, the attacker can execute arbitrary commands, potentially compromising the host system or application. The impact is severe due to the ability to run arbitrary code with the privileges of the affected process.

No official patch or remediation is currently available for [email protected]. Users and organizations should avoid installing or using this package. If already installed, remove it immediately from all environments and replace it with trusted alternatives. Monitor dependency trees to detect and exclude this malicious package. Since this is a malicious package, no legitimate fix exists; the best mitigation is to not use it.