The eth-react-redirection npm package (version 1.0.0) is a malicious package that pretends to be a React navigation library but actually contains injected remote code execution payloads. Its lib/levels.js file includes a top-level immediately-invoked function expression (IIFE) that performs an HTTP GET request to an attacker-controlled URL. If the response is a 404, it extracts a token from the response body and executes it as JavaScript code with the package's require binding, enabling arbitrary code execution. Additionally, it stores a base64-encoded secondary URL used as a backup payload source. The index.js file spawns a detached Node.js child process with ignored stdio and unreferenced handles on every require, further obfuscating malicious activity. This remote-execution occurs immediately upon requiring the package, meaning any consumer of this package is at risk of executing attacker-supplied code.

Any application or environment that installs and requires eth-react-redirection version 1.0.0 is vulnerable to remote code execution by an attacker controlling the payload URLs. This allows arbitrary JavaScript execution within the context of the Node.js process, potentially leading to full system compromise, data theft, or further malicious activity. The malicious code executes silently and immediately on module load, increasing the risk of unnoticed exploitation.

No official patch or remediation is currently available for eth-react-redirection version 1.0.0. Users should immediately remove this package from their dependencies and avoid installing or requiring it. Since the package fetches payloads over unencrypted HTTP from attacker-controlled endpoints, blocking network access to these URLs can provide temporary mitigation. Monitor dependency sources carefully to avoid installing similarly disguised malicious packages. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.