The 'type-elint' npm package version 3.3.7 masquerades as the pino logger but includes a middleware factory that spawns a detached Node.js child process executing code retrieved from hardcoded remote URLs. These URLs are base64-encoded and hidden under a decoy environment variable to evade detection. The retrieved JavaScript is evaluated dynamically using the Function constructor with require in scope, enabling arbitrary code execution controlled by the attacker. Because the payload is hosted on mutable third-party paste services, the attacker can modify the delivered code at any time without updating the package itself. This behavior effectively compromises any system running this package.

Systems with 'type-elint' version 3.3.7 installed are fully compromised due to arbitrary code execution from attacker-controlled remote code. This can lead to complete system takeover, data theft, and unauthorized access. All secrets and keys stored on the affected system should be considered exposed and must be rotated immediately. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the payload.

No official patch or fix is currently available. Immediate removal of the 'type-elint' package version 3.3.7 from all systems is recommended. All secrets, credentials, and keys stored on affected systems should be rotated from a separate, secure environment. Because the package enables full system compromise, affected systems should be treated as fully compromised and undergo thorough incident response and forensic analysis. Monitor for any signs of persistent malicious activity beyond package removal.