The package @bcryptln/becryptjs, which mimics the widely-used bcryptjs library, includes a malicious payload appended after legitimate code in its ESM entrypoint (index.js). The payload uses custom string-shuffle decoders to hide the use of the JavaScript Function constructor, which is dynamically created and invoked. It re-exposes CommonJS primitives such as require, module, __dirname, and __filename as globals, allowing the payload to access powerful Node.js modules like fs, child_process, http, and net. The CommonJS/UMD entrypoint (umd/index.js) is a clean copy of the upstream library, making the malicious code only active when the package is imported as an ESM module. This split and obfuscation strategy indicates an intentional supply-chain trojan designed to evade code review and detection.

Consumers importing @bcryptln/becryptjs as an ESM module risk executing malicious code with full CommonJS module access, potentially allowing arbitrary code execution, filesystem manipulation, network communication, and process spawning. This compromises the security and integrity of applications using this package version.

No official patch or remediation guidance is currently available. Users should avoid using the affected versions of @bcryptln/becryptjs (=3.0.8, =3.0.10, =3.0.11). Instead, they should switch to the legitimate bcryptjs package or verify package authenticity before use. Monitor vendor advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.