The auth-next-gen npm package versions 1.6.29, 1.7.2, and 1.7.11 include a malicious module (writer.js) that performs an axios GET request to a base64- and hex-obfuscated URL hosted on jsonkeeper.com, an anonymous pastebin service. The response body is passed directly to eval(), enabling arbitrary code execution controlled by the attacker at install or runtime. Concurrently, the module collects extensive system information including environment variables, OS platform, hostname, username, and MAC addresses, which it stages for exfiltration alongside the fetched payload. The package's metadata and assets are designed to appear as a legitimate SSR auth-sync helper, using assets from the pino logger project as a lure. Because the payload is hosted on a mutable external service, the executed code can change dynamically without any package update. This results in a fully compromised system upon installation or execution of the package.

Any system with the affected versions of auth-next-gen installed or running is fully compromised, as the package executes arbitrary attacker-controlled code and exfiltrates sensitive system information. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately. Removal of the package alone does not guarantee eradication of all malicious artifacts or backdoors introduced by the attacker.

No official patch or fix is available. Immediate removal of the auth-next-gen package versions 1.6.29, 1.7.2, and 1.7.11 is strongly recommended. All secrets, credentials, and keys on affected systems should be rotated from a separate, trusted environment. Due to the severity and nature of the compromise, affected systems should be treated as fully compromised and undergo thorough incident response and remediation.