[email protected] is a malicious npm package impersonating cryptocoinjs/base-x by copying its README, homepage, and API surface. Unlike the genuine package, its decode(string) function contains a large (~123KB) VM-style obfuscated payload that uses rotated identifiers and dynamic code construction via the Function constructor and fetch API. This enables outbound network communication and execution of concealed code, indicating potential remote control or data exfiltration capabilities. The obfuscation hides the destination hosts and payload details. Any invocation of decode() executes this malicious VM, compromising the host system.

Any system with [email protected] installed or running is considered fully compromised. The malicious code can execute dynamically constructed payloads with network access, potentially allowing attackers to control the system, exfiltrate data, or deploy further malware. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not fully remediate the compromise due to possible persistence mechanisms.

Remove the [email protected] package immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored or used on the compromised systems from a separate, trusted computer. Because the package grants potential full control to attackers, conduct a thorough investigation and consider rebuilding affected systems to ensure complete remediation. No official patch or fix is available for this malicious package since it is a trojanized impersonation rather than a vulnerability in legitimate software.