The random-string-64 npm package (versions 1.0.0 and 1.0.1) advertises a simple random string generator but contains a hardcoded AES-256-CBC encrypted JavaScript payload. This payload is decrypted using a SHA-256 derived key and executed via a dynamically reconstructed eval function. The package performs environment detection to avoid execution in CI, npm bot, container, or virtual machine environments, only running the malicious code on developer machines. This behavior allows execution of attacker-controlled code with the privileges of the importing process, constituting a supply-chain attack vector. No official patch or remediation is indicated in the provided data.

Any developer machine that imports random-string-64 and calls its getUniqueID(64) function executes attacker-controlled code with the same privileges as the calling process. This can lead to arbitrary code execution, potentially compromising the developer environment and any systems accessible from it. The obfuscation and anti-analysis techniques increase the risk of undetected compromise in development workflows.

No official patch or remediation is currently documented. Users should immediately avoid using random-string-64 versions 1.0.0 and 1.0.1. Remove the package from projects and replace it with a trusted alternative. Monitor for any unusual activity on developer machines that used this package. Check vendor advisories or trusted security sources for updates or fixes.