The express-session-kit package mimics the express-session library by copying its name pattern, author metadata, and repository fields. It includes a dropper function that spawns a detached Node.js subprocess to run a payload script. This payload performs an HTTP GET request to a remote server endpoint, expecting a 404 response containing a JSON token. The token is then wrapped in a new Function call and executed with the real require function, enabling arbitrary code execution in the Node.js environment. Although the current dropper has a path typo that prevents immediate execution, the payload script is present and directly requireable, meaning any consumer requiring it or a trivial fix in future versions would activate the RCE. This is a deliberate supply-chain attack exploiting typosquatting to compromise developer environments.

Any system that installs or runs the express-session-kit package is at risk of full compromise due to remote code execution capabilities. Attackers can execute arbitrary code within the Node.js process, potentially leading to theft of secrets, keys, and full system control. The presence of this package on a system indicates a high likelihood of compromise, and all sensitive credentials on the affected system should be considered exposed and rotated immediately. Removing the package alone may not fully remediate the compromise as attackers may have already installed additional malicious software.

No official patch or fix is available since this is a malicious package rather than a vulnerability in legitimate software. The recommended mitigation is to immediately remove the express-session-kit package from all systems. All secrets and keys stored on affected systems should be rotated from a separate, trusted environment. Developers should verify package names carefully to avoid typosquatting attacks and rely on official package sources. Monitor for any suspicious activity indicating persistent compromise beyond the package removal.