The 'type-atob' npm package version 3.3.7 masquerades as a pino-style logger but contains malicious functionality. Upon requiring the module, it spawns a detached Node.js child process running a script that fetches JSON data from attacker-controlled paste hosting services. It extracts a 'cookie' field from the JSON response and executes it as JavaScript code with full access to Node's require function, enabling arbitrary code execution. Additional attacker-controlled endpoints are embedded as base64-encoded strings within the package. The detached and stdio-ignored child process conceals this malicious loader from the parent process, leading to a fully compromised system once the package is installed or running.

Any system with 'type-atob' version 3.3.7 installed or running is considered fully compromised. The attacker gains full control over the host environment, including the ability to execute arbitrary code with Node.js privileges. This compromises all secrets and keys stored on the system, necessitating immediate rotation from a secure environment. Removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

No official patch or fix is currently available for this malicious package. The recommended mitigation is to immediately remove 'type-atob' version 3.3.7 from all affected systems. Additionally, all secrets, keys, and credentials stored on compromised systems should be rotated from a separate, secure environment. Due to the nature of the compromise, a full system investigation and potential rebuild may be necessary to ensure complete remediation.