The 'authsessionbridge' npm package performs a remote fetch of JavaScript code from base64- and hex-obfuscated URLs hosted on jsonkeeper.com. This fetched code is executed directly using eval(), with access to an object containing the full process environment variables, OS platform, hostname, username, and MAC addresses. The package disguises itself as the 'pino' logger by including similarly named files and keywords to lure installations. This design grants the remote operator arbitrary code execution and full access to sensitive host information, effectively compromising any system that installs or runs this package.

Systems with 'authsessionbridge' installed are fully compromised, allowing attackers arbitrary code execution and access to all environment variables and host identifiers. This can lead to theft of secrets, credentials, and other sensitive data. The compromise is severe enough that removing the package alone does not guarantee eradication of all malicious artifacts or backdoors. Immediate secret rotation is required to mitigate ongoing risk.

No official patch or fix is available. The package should be immediately removed from all systems. All secrets and keys stored on compromised systems must be rotated from a different, trusted machine. Because the attacker may have persistent access, further forensic analysis and remediation are recommended to ensure complete removal of malicious code and backdoors.