The 'eth-base' npm package version 1.0.0 is a malicious package that includes a large obfuscated JavaScript payload appended to a legitimate web3-core-subscriptions module. Upon requiring the package, an immediately invoked function expression (IIFE) loads the axios library to make an HTTPS request to a dynamically reconstructed URL. The response from this request is used to construct and execute a new Function with full Node.js require capabilities, allowing execution of arbitrary attacker-controlled JavaScript code in the process. The clean source code does not contain this payload, indicating the malicious code was injected only into the published build. The package name and description impersonate a known web3.js helper, but the repository field is empty, suggesting malicious intent to deceive users. This results in arbitrary code execution on the installing host at load time.

Consumers who install or require 'eth-base' version 1.0.0 are subject to arbitrary code execution on their host environment. This can lead to full compromise of the system running the Node.js process, including unauthorized access to files, network, and other resources accessible via Node's require system. The malicious payload executes immediately upon loading the package, increasing the risk of compromise during installation or runtime.

No official patch or remediation is currently available for this malicious package. Users should avoid installing or requiring 'eth-base' version 1.0.0 from npm. Verify package authenticity before use and prefer official, well-maintained packages from trusted sources. Since this is a malicious package impersonating a legitimate library, removing the package and scanning for any signs of compromise on affected hosts is recommended. Monitor npm advisories and vendor communications for any updates or official guidance.