Notify-dist version 1.3.7 is a malicious npm package that pretends to be a pino-compatible logger but instead executes remote code. Upon invocation, it spawns a detached child process that performs HTTP GET requests to attacker-controlled URLs hosted on jsonkeeper.com. The fetched JavaScript code is executed with full Node.js privileges using the Function constructor, allowing arbitrary code execution. The package uses multiple endpoints for payload rotation and suppresses console logs to evade detection. This results in a remote code execution vulnerability triggered simply by requiring and invoking the package's exported middleware.

Any application or developer that installs and uses notify-dist version 1.3.7 is at risk of arbitrary remote code execution. The attacker-controlled payload can execute any code with the same privileges as the Node.js process, potentially leading to full system compromise, data theft, or further malware deployment. Because the payload is fetched from a mutable third-party JSON host, the malicious code can change dynamically, increasing the risk and difficulty of detection.

There is no official patch or fix available for notify-dist version 1.3.7. Users should immediately remove this package from their projects and avoid installing it. Since the package is malicious by design, replacing it with a legitimate logging library such as the official pino package is recommended. Monitor dependencies carefully to prevent inclusion of similarly malicious packages. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.