The crypto-promiser package versions 1.0.1 and 1.0.2 contain malicious code that executes arbitrary JavaScript fetched from an anonymous external paste host. The package's postinstall lifecycle script runs a prepinstall.js script that decodes a base64 URL, fetches JSON data, and pipes a field from the response into a detached Node.js process, executing attacker-controlled code. Additionally, the package's index.js dynamically imports prepinstall.js on require or import, triggering the same malicious fetch-and-execute behavior. This typosquatting package closely mimics the legitimate crypto-promise API to lure victims. The remote payload source is mutable and obfuscated, enabling persistent arbitrary code execution on any machine that installs or uses the package.

Arbitrary code execution occurs on the installer machine both at install time and at runtime when the package is imported or required. This leads to full compromise of the affected system, including potential unauthorized access to secrets, keys, and other sensitive data stored on the machine. Because the attacker-controlled payload is fetched from a mutable external source, the malicious code can be changed dynamically, increasing the risk and persistence of the compromise. Systems with this package installed should be treated as fully compromised.

No official patch or fix is currently available. The package crypto-promiser versions 1.0.1 and 1.0.2 should be immediately removed from all systems. All secrets and cryptographic keys stored on compromised machines must be rotated from a secure, unaffected environment. Due to the full compromise risk, additional forensic analysis and remediation may be necessary to ensure no residual malicious code remains. Avoid installing similarly named packages and verify package authenticity before installation.