The malicious type-async package (version 3.3.7) impersonates the pino package and exports a middleware factory that spawns a detached Node.js child process. This child process fetches a JSON payload from an untrusted, mutable remote pastebin URL, extracts a cookie field, and dynamically constructs and executes a function with the host's require context. The payload URLs are obfuscated in base64 within fake environment variables inside the package code. Because the fetched content is unpinned and executed without integrity verification, an attacker controlling the remote pastebin can execute arbitrary code on any system that installs this package version.

Systems that install and run type-async version 3.3.7 are at risk of arbitrary code execution by attackers controlling the remote JSON payload. This can lead to full compromise of the host environment with access to all Node.js modules and capabilities. The malicious code is delivered via a typosquatting package, increasing the risk of accidental installation.

No official patch or remediation is currently documented. Users should immediately verify their dependencies to ensure type-async version 3.3.7 is not installed. Remove this package if found. Avoid installing packages with suspicious or typosquatting names. Monitor vendor advisories and trusted sources for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.