The @apicity/meta npm package versions 0.8.0 through 0.8.6 include code that references litter.catbox.moe, an anonymous and mutable file-hosting service. This host is known to be used in the TanStack/Shai-Hulud npm supply-chain compromise campaign as a second-stage payload delivery mechanism. The presence of such a host in runtime code is anomalous and indicative of malicious intent, as it allows the package to fetch and execute attacker-controlled code dynamically during installation or runtime. This behavior exposes users of the package to arbitrary code execution risks tied to the content served by the external host at the time of resolution.

Consumers who install or load affected versions of @apicity/meta are exposed to arbitrary code execution risks because the package fetches and runs code from an untrusted, anonymous external host. This can lead to compromise of the user's environment, data theft, or further malware deployment. The threat is tied to the dynamic retrieval of attacker-controlled payloads, making the impact potentially severe depending on the payload served.

No official patch or remediation guidance is currently available. Users should avoid installing or using affected versions of @apicity/meta (0.8.0 through 0.8.6). Consider removing the package from projects and replacing it with trusted alternatives. Monitor vendor advisories or the package repository for updates or official fixes. Due to the nature of the malicious code, manual code inspection and blocking network access to the referenced host may provide temporary mitigation.