The notifier-funcs package (version 1.3.4) includes a backdoor where, upon requiring the package, it spawns a detached Node.js child process that runs a script (lib/vcall.js). This script fetches JavaScript code from a hardcoded remote URL (https://api.jsonsilo.com/public/c6c0b393-932f-4ae1-8fca-23c6747f4acc) using axios, extracts a field from the JSON response, and executes it using Function.constructor, resulting in arbitrary code execution on the host machine. Additionally, a secondary endpoint is encoded in base64 pointing to another mutable JSON hosting URL (https://jsonkeeper.com/b/ZK45J). The package falsely advertises itself as a pino-style logger but serves as a cover for this remote fetch-and-execute behavior. The detached child process hides the malicious payload from the parent process, complicating detection.

This vulnerability allows an attacker controlling the remote JSON endpoints to execute arbitrary code on any machine that installs or requires notifier-funcs version 1.3.4. This can lead to full system compromise, data theft, or further malware deployment. The attack is stealthy due to the detached child process and the use of mutable third-party JSON hosting services, which can change payloads at any time.

No official patch or remediation is currently available for notifier-funcs version 1.3.4. Users should immediately avoid installing or using this package. If already installed, remove it from all environments. Monitor dependency trees for this package and replace it with trusted alternatives. Since the package fetches code from external mutable endpoints, blocking network access to these URLs may reduce risk but does not fully mitigate the threat. Check vendor advisories or trusted security sources for updates on remediation.