The notify-funcs package (versions 1.3.5 and 1.3.6) pretends to be a logging middleware compatible with pino but actually spawns a detached Node.js child process running lib/vcall.js. This child process fetches JavaScript code from a remote IPFS gateway URL and executes it dynamically via Function constructor, granting the remote payload full Node.js capabilities. The detached process is designed to persist beyond the parent process exit. Additional base64-encoded strings in the package reference anonymous paste-host endpoints, indicating further staging infrastructure. The package's API surface is a decoy to facilitate arbitrary remote code execution on any host that uses it as Express middleware.

Any system that installs and uses notify-funcs versions 1.3.5 or 1.3.6 as middleware is vulnerable to arbitrary remote code execution. The attacker can execute any code with the privileges of the Node.js process, potentially leading to full system compromise, data theft, or further lateral movement. The detached child process mechanism allows the malicious code to persist independently of the parent process, increasing the risk and difficulty of detection and removal.

No official patch or remediation is currently available for notify-funcs versions 1.3.5 and 1.3.6. Users should immediately cease using these versions and remove the package from their projects. Avoid installing or running this package from untrusted sources. Monitor for any usage of notify-funcs in your environment and replace it with a trusted alternative. Check vendor advisories or trusted security sources for updates or official fixes.