The 'buffer-util-extend' npm package versions 1.0.1 through 1.0.13 (including 1.0.8, 1.0.11, and others) contain a supply-chain attack where the package's index.js decodes a base64-encoded URL pointing to a mutable JSON paste. It fetches this JSON and executes the 'content' field via eval(), allowing an attacker to run arbitrary code on the install/build machine at import time. The package mimics the legitimate 'buffer' package by copying its metadata and source code but adds malicious dependencies and the remote code execution payload. This design enables attackers to swap payloads at any time without republishing the package, posing a severe risk to any system that installs or uses it.

Any computer that installs or runs this package is fully compromised due to arbitrary code execution at import time. Attackers can execute any code on the affected system, potentially stealing secrets, installing persistent malware, or performing other malicious actions. Secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a secure environment. Removing the package alone may not remove all malicious artifacts or backdoors introduced by the attacker.

Immediate removal of the 'buffer-util-extend' package is required. All secrets and keys on affected systems must be rotated from a different, trusted machine. Because the package executes remote code dynamically, full system compromise is likely; therefore, a thorough incident response and system rebuild may be necessary. There is no official patch or fix available; the package itself is malicious. Avoid using this package and verify dependencies carefully to prevent supply-chain attacks.