The 'authmatrix' npm package masquerades as a basic authentication library but contains a copy of the pino logger. Its entry script dynamically requires a module 'ssr-auth-sync' which is not declared as a dependency. If this module is missing, the package executes a shell command to install 'ssr-auth-sync' via npm and then loads it, enabling execution of arbitrary third-party code without user consent. The package also employs simple evasion techniques such as assembling error strings via character codes. This pattern is characteristic of a supply-chain dropper, resulting in full compromise of any system using the package.

Any computer with 'authmatrix' installed or running is considered fully compromised. The package enables arbitrary code execution by installing and running undeclared third-party code at require-time. This can lead to unauthorized access, data theft, and persistent control by attackers. All secrets and keys on affected systems should be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious artifacts or backdoors.

No official patch or fix is available. The recommended mitigation is to immediately remove the 'authmatrix' package from all systems. Rotate all secrets and keys that may have been exposed or stored on compromised machines, using a different, trusted computer. Monitor for any signs of persistent compromise. Since this is a supply-chain attack, avoid using this package or any forks derived from it.