The 'cors-update' npm package copies the legitimate 'expressjs/cors' source code but adds an exported 'getPlugin' factory function that performs an HTTPS GET request to a hardcoded attacker-controlled URL (https://api.avax-test.dev/ext/bc/rpc) with TLS verification disabled (rejectUnauthorized: false). The response body is passed to 'new Function' and executed with full 'require' access, allowing arbitrary JavaScript code execution within the consumer's Node.js process. Variable names in the code attempt to disguise the malicious request as a blockchain RPC call. The 'https' module is used without being imported at the top of the file, indicating obfuscation. Any application that installs this package as a replacement for the legitimate 'cors' middleware and invokes the exported factory is exposed to remote code execution.

This vulnerability allows remote attackers to execute arbitrary code within the Node.js process of any application that installs and uses the 'cors-update' package as a substitute for the legitimate 'cors' middleware. The attacker-controlled code runs with full access to Node.js modules via 'require', potentially leading to complete system compromise, data theft, or further malicious activity. The disabling of TLS verification increases the risk of man-in-the-middle attacks during code fetch.

No official patch or remediation is currently available for this malicious package. Users should immediately remove 'cors-update' from their dependencies and replace it with the legitimate 'cors' package from the official npm registry. Verify package authenticity before installation to avoid supply chain attacks. Monitor for any unexpected network activity related to the hardcoded URL and audit systems for signs of compromise if this package was used.