The 'nullrift' npm package version 1.0.0 advertises itself as an SVG fetcher/sanitizer but includes an undocumented getPlugin() function. This function performs an HTTP request to a public paste host (jsonkeeper.com) with a custom header, retrieves JSON data, and directly executes the 'model' field using eval(). Since the paste host is publicly writable and anonymous, an attacker controlling the paste can modify the content at any time, resulting in arbitrary JavaScript execution within any environment that calls this function. This constitutes a supply-chain backdoor enabling remote code execution on downstream consumers.

Consumers of 'nullrift' version 1.0.0 who invoke the undocumented getPlugin() function are at risk of arbitrary code execution controlled by an attacker with access to the mutable paste on jsonkeeper.com. This can lead to full compromise of the runtime environment where the package is used. The malicious code is hidden and inconsistent with the package's stated functionality, increasing the risk of unnoticed exploitation.

No official patch or remediation is currently available for this malicious package version. Users should avoid using 'nullrift' version 1.0.0 entirely. Remove the package from any projects and replace it with a trusted alternative. Monitor dependencies for malicious or unexpected code, especially those fetched from public or anonymous sources. Since this is a supply-chain backdoor, strict vetting of third-party packages is recommended.