The note-utilities package (version 2.1.2) pretends to be a pino-style logger but includes a malicious loader script (lib/vcall.js). Upon requiring the package, index.js spawns a detached Node.js child process running lib/vcall.js, which performs an HTTPS GET request to a remote JSON endpoint controlled by an attacker. The returned JavaScript code is dynamically constructed and executed using Function constructor with access to the real require function, enabling arbitrary code execution with the privileges of the installing process. The remote endpoint is mutable by the attacker, making this a supply chain attack vector.

This vulnerability allows an attacker to execute arbitrary JavaScript code on any system that installs note-utilities version 2.1.2. The malicious code runs with the same privileges as the user installing the package, potentially leading to full system compromise, data theft, or further malware deployment. Because the malicious code is fetched dynamically from a remote endpoint, the attacker can change the payload at any time after installation.

No official patch or remediation is currently available for note-utilities version 2.1.2. Users should avoid installing or using this package version. Verify package authenticity before installation and consider using trusted package sources or alternatives. Monitor vendor advisories for any updates or fixes. Since this is a malicious package, removal from the environment and investigation of any installed instances is recommended.