The 'buffer-util-internal' npm package is a malicious impersonation of the widely-used 'buffer' package. It includes a top-level immediately-invoked function expression (IIFE) that base64-decodes a hardcoded URL, fetches a JSON document from an anonymous paste hosting service, and executes the 'content' field of the response using eval. This allows an attacker to remotely execute arbitrary JavaScript code on any system that installs or requires this package. The package also declares suspicious dependencies inconsistent with the legitimate 'buffer' package, further indicating malicious intent. The affected versions are exactly 1.0.13 and 1.0.14.

Any consumer that installs or requires 'buffer-util-internal' versions 1.0.13 or 1.0.14 will execute attacker-controlled JavaScript code at install or require time, resulting in a full remote code execution capability on the affected system. This can lead to complete compromise of the host environment.

No official patch or fix is currently documented. Users should immediately remove and avoid using the 'buffer-util-internal' package, especially versions 1.0.13 and 1.0.14. Verify dependencies to ensure the legitimate 'buffer' package is used instead. Monitor package sources carefully to avoid supply chain attacks from malicious impersonation packages.