The express-request-engine package version 3.6.3 is a malicious npm package that, upon being imported, calls a top-level function which fetches data from an external JSON bin controlled by an anonymous account. It extracts a field named 'cerookie' from the response and executes it as JavaScript code using the Function constructor with access to the consumer's require function. This results in arbitrary code execution with full privileges in the importing process. The package falsely advertises itself as a normalize-path utility, and the obfuscated payload delivery indicates intentional concealment rather than misconfiguration. No patch or fix is currently available, and the package is not a cloud service.

Any process importing express-request-engine version 3.6.3 will execute arbitrary attacker-controlled JavaScript code with full module-loading privileges. This can lead to complete compromise of the host environment running the affected package. The attacker can modify the external JSON resource at any time to change the malicious payload, making the threat persistent and dynamic.

No official patch or remediation is currently available for express-request-engine version 3.6.3. Users should immediately remove this package from their dependencies and avoid importing it. Consider auditing your environment for any usage of this package and replace it with a trusted alternative. Monitor for any unexpected network connections or code execution related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.