The 'endpointmap' npm package (versions 2.1.0 and 3.0.0) advertises itself as a REST endpoint registry but includes a two-package smuggle pattern. It exports two non-printable byte arrays that are not used internally, while declaring an unpinned dependency on 'bytecraft'. The 'bytecraft' package is never imported by 'endpointmap' code but is installed alongside it, enabling the decoding and execution of the opaque data at runtime. This separation allows malicious payload delivery through the 'bytecraft' package, which can be updated independently to introduce malicious behavior without modifying 'endpointmap'. This pattern is a known evasion technique to bypass per-package review.

Users installing 'endpointmap' versions 2.1.0 or 3.0.0 are exposed to potentially malicious code execution via the unpinned 'bytecraft' dependency. Because 'bytecraft' is not fixed to a specific version, an attacker can publish a malicious version of 'bytecraft' that will be installed automatically, enabling arbitrary code execution or other malicious actions during installation or runtime. This compromises the security of any environment that installs these versions of 'endpointmap'.

No official patch or fix is currently documented for this issue. Users should avoid installing 'endpointmap' versions 2.1.0 and 3.0.0. If already installed, remove these versions and audit dependencies for unpinned or suspicious packages like 'bytecraft'. Pin dependencies explicitly to known safe versions and monitor for updates from the package maintainers or security advisories for any official remediation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.