The async-mutex-lock npm package version 5.3.1 is advertised as a mutex-lock utility but does not provide the documented API. Its sole export, getPlugin, constructs a URL pointing to a bare IP address (https://31.97.137.157:45000/icons/108), fetches a JSON response, and executes the 'data.credits' field as JavaScript code with full access to require, process, and Buffer contexts. The package attempts to disguise its malicious intent by referencing well-known CDN names while actually contacting an unrelated IP address. It declares dependencies (@primno/dpapi, node-machine-id, better-sqlite3, socket.io-client) that align with infostealer malware capabilities, including DPAPI decryption, machine fingerprinting, SQLite browser store access, and socket-based command and control communication. The package name closely resembles the legitimate async-mutex package, likely to deceive users.

This package enables remote code execution of attacker-controlled JavaScript on the host environment, potentially allowing attackers to steal sensitive information such as machine identifiers, decrypted credentials, and browser data. The presence of infostealer-related dependencies indicates a high risk of data exfiltration and system compromise. Users installing this package version may unknowingly execute malicious code leading to significant security breaches.

No official patch or remediation is currently documented. Users should immediately avoid installing or remove version 5.3.1 of async-mutex-lock. Verify package authenticity before installation, prefer official and well-maintained packages, and monitor for updates or advisories from trusted sources. Since this is a malicious package impersonating a legitimate one, consider using package integrity verification tools and supply chain security measures to prevent similar threats.