node-path-addon is a malicious npm package that pretends to extend the Node.js 'path' module. Its main module requires 'path-addon-extend' at a wildcard version '*', causing the latest version of that external package to be loaded and executed. Since the external dependency is mutable and controlled by a third party, this design allows arbitrary code execution in the consumer's process whenever node-path-addon is installed or required. The package also imports 'https' without use and misleads users with README instructions to install a similarly named package, consistent with typosquatting tactics. No direct payload such as exfiltration or shell execution is present in node-path-addon itself, but the indirect code execution risk is significant.

Consumers of node-path-addon version 1.0.8 are at risk of arbitrary code execution due to the wildcard dependency on path-addon-extend, which can be updated by an attacker at any time. This can lead to compromise of the environment where the package is installed. There are no known exploits in the wild currently. The malicious package does not itself contain direct exfiltration or shell execution code but enables execution of arbitrary code via the external dependency.

Avoid using node-path-addon entirely, especially version 1.0.8, as it is a malicious typosquatting package. There is no official fix or patch available. Users should verify package names carefully before installation and rely on trusted sources. Remove node-path-addon from any projects and replace with the legitimate Node.js 'path' module or a trusted alternative. Monitor dependencies for typosquatting or suspicious wildcard dependencies.