The 'type-plint' npm package version 3.3.7 exports middleware that spawns a detached Node.js child process executing 'lib/caller.js'. This script performs HTTP GET requests to mutable third-party JSON-bin URLs and passes the retrieved strings to a dynamically constructed Function constructor, invoking it with Node's require function. This allows arbitrary code execution with full module access within the host process. The package disguises these URLs as base64-encoded environment variable defaults, a known evasion technique for staged remote code loaders. The package's API mimics the pino logger but acts as a wrapper around this fetch-and-eval loader, effectively delivering a remote code execution backdoor.

Any system with 'type-plint' version 3.3.7 installed or running is fully compromised due to arbitrary remote code execution capabilities. Attackers can execute any code with full access to the Node.js environment, potentially leading to data theft, credential exposure, persistence mechanisms, and further system compromise. All secrets and keys stored on the affected system should be considered exposed and must be rotated from a secure environment. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is currently available for this malicious package. Immediate removal of 'type-plint' version 3.3.7 from all systems is strongly recommended. Treat affected systems as fully compromised: rotate all secrets and keys from a separate, trusted environment. Conduct a thorough investigation and remediation of the host to ensure no residual malicious code or backdoors remain. Monitor for any suspicious activity related to this package's usage.