The 'notify-theme' npm package (versions 1.3.5 to 1.3.7) masquerades as the pino logger by exporting similarly named modules and files. However, its actual behavior is malicious: upon invocation, it spawns a detached Node.js child process that performs an HTTP GET request to a remote anonymous paste service (jsonkeeper.com) to retrieve JavaScript code. This code is then executed in the context of the host process using the Function constructor and the host's require function, granting the attacker arbitrary code execution capabilities with full module access. The package hides the command and control (C2) URL and headers inside environment-like variables within a local object to evade detection. The use of an anonymous, mutable paste host allows the attacker to change the payload at will without updating the package, increasing the threat's stealth and persistence.

This vulnerability allows an attacker to execute arbitrary code remotely within the Node.js process that imports the malicious 'notify-theme' package. This can lead to full compromise of the host environment, including access to all modules and potentially sensitive data or system control. The dynamic nature of the payload, fetched from an anonymous mutable paste host, means the attacker can change the malicious code at any time, increasing the risk and making detection and mitigation more difficult.

No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid using the 'notify-theme' package versions 1.3.5, 1.3.6, and 1.3.7 entirely. Developers should verify the authenticity of packages before installation, prefer well-known and trusted logging libraries, and audit dependencies for suspicious behavior. Since this is a malicious package impersonating a legitimate API, removing it from projects and replacing it with a verified logger package is recommended. Monitor for any unexpected child processes or network requests initiated by Node.js applications.