The clx-cookie-signature package (version 1.2.1) is a malicious npm package impersonating the popular cookie-signature library by copying its README, author metadata, and API. Its index.js contains a top-level dropper that immediately executes upon require(), fetching JavaScript code from a mutable external URL (https://www.jsonkeeper.com) and evaluating it via eval(). This allows the attacker to run arbitrary code in the context of the consuming process. The package also includes an obfuscated fallback payload URL, enabling dynamic and persistent malicious payload delivery without republishing the package. This is a clear case of a malicious package designed for remote code execution through supply chain compromise.

Any project that installs and requires clx-cookie-signature version 1.2.1 runs attacker-controlled code, resulting in full compromise of the host system. The attacker can execute arbitrary commands, potentially stealing secrets, credentials, or other sensitive data. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and rotated immediately from a trusted environment. Removing the package alone may not fully remediate the compromise due to potential persistence mechanisms installed by the attacker.

There is no official patch or fix available for this malicious package. The recommended action is to immediately remove clx-cookie-signature version 1.2.1 from all systems. Consider all systems with this package installed as fully compromised. Rotate all secrets and keys from a clean, uncompromised environment. Audit affected systems for additional malicious software or persistence mechanisms. Avoid installing packages with suspicious or typo-squatting names and verify package authenticity before use.