The 'express-plugin' npm package (version 1.6.6) automatically invokes an initialization function on load that performs an HTTP GET request to a mutable third-party URL (https://jsonkeeper.com/b/PRA3O). It parses the JSON response and extracts a 'cookie' field, which is then passed to the JavaScript Function constructor with 'require' exposed, immediately executing arbitrary code fetched remotely. This design grants the attacker full control over the executing environment with Node.js privileges. The package is disguised as an Express middleware and exports a decoy normalizePath function to evade detection. Because the remote payload is attacker-controlled and mutable, the malicious behavior can change dynamically without any new package version release.

Any process that requires 'express-plugin' version 1.6.6 will execute attacker-controlled code with full Node.js privileges, potentially leading to complete system compromise, credential theft, persistence mechanisms, or other malicious activities. The dynamic nature of the remote payload means the attacker can alter the malicious code at any time without republishing the package, increasing the risk and difficulty of detection.

No official patch or remediation is currently documented for this package version. Users should immediately remove 'express-plugin' version 1.6.6 from their dependencies and avoid using this package. Since the malicious code executes on module load, uninstalling or replacing the package with a trusted alternative is critical. Monitor for any usage of this package in your environment and conduct a thorough investigation if found. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.