The notify-utilities package (version 1.3.5) impersonates the pino logger by copying its package.json description, keywords, and type definitions. Upon requiring and invoking its exported factory, it spawns a detached, unreferenced Node.js child process that performs an HTTP GET request to a third-party JSON storage service controlled by an attacker. The response contains JavaScript source code which is dynamically constructed into a function and executed with access to the live require function, enabling arbitrary code execution within the installer's Node.js process. The detached and unref child process design conceals ongoing remote code execution from the main process, increasing stealth. The remote code is mutable and not tied to any signature or version, making the threat persistent and dynamic.

This malicious package enables remote code execution within the Node.js environment of any user who installs and invokes it, potentially allowing attackers to execute arbitrary code with the privileges of the user running the Node.js process. The dynamic fetching and execution of attacker-controlled code without signature verification or version pinning increases risk of persistent and evolving malicious payloads. This can lead to compromise of the development environment, supply chain contamination, and further downstream impacts.

No official patch or remediation is currently available. Users should immediately avoid installing or using notify-utilities version 1.3.5. Remove this package from any projects and dependency trees. Verify that no instances of this package remain in your environment. Consider auditing your environment for any signs of compromise related to this package. Monitor vendor advisories for updates or official remediation guidance.