The async-mutex-v3 package at version 3.1.0 is a typosquatting malicious package on npm. It exports a default function that issues an HTTP request to a hardcoded bare IP endpoint (http://46.183.25.232:45000/icons/108). The response's 'credits' field is passed into a new Function constructor with Node.js context variables, resulting in execution of attacker-supplied JavaScript code with full Node.js privileges (including access to require, process, and Buffer). The package uses misleading variable names and paths to appear as an icon CDN helper, but actually loads code from the bare IP address. Declared dependencies align with a credential-stealing post-exploitation pipeline. Any consumer requiring this package and invoking the default export triggers remote code execution.

This vulnerability allows remote code execution in any environment that imports async-mutex-v3 version 3.1.0 and calls its default export. The attacker-controlled code runs with Node.js privileges, potentially enabling credential theft, system compromise, and further malicious activity. The malicious package is a typosquat, so users who mistakenly install it instead of the legitimate async-mutex package are at risk.

No official patch or remediation is currently documented. Users should avoid installing or using async-mutex-v3 version 3.1.0. Verify package names carefully to avoid typosquatting attacks. Remove this package from any projects and replace with the legitimate async-mutex package if needed. Monitor package sources and use trusted registries. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.