The 'encrypt-string-safe' npm package version 2.2.0 includes heavily obfuscated code that routes all exported API calls through an internal function which fetches JavaScript from a malicious third-party host (http://npm.jsdelivree.com/encrypt-string-admin-core/core.js). This domain mimics the legitimate jsdelivr CDN but uses a different TLD (.com vs .net). The fetched script is executed dynamically via 'new Function', enabling remote code execution. The transport uses plain HTTP without TLS, and the only integrity check is a simple marker-string search, providing no real security. This design allows an attacker to control code execution in any environment that imports and uses this package version.

Any application or environment that installs and invokes the documented API of 'encrypt-string-safe' version 2.2.0 is vulnerable to remote code execution by an attacker controlling the third-party host. This can lead to full compromise of the affected system or environment. The obfuscation and use of a lookalike domain make detection difficult.

No official patch or fix is currently documented. Users should immediately cease using 'encrypt-string-safe' version 2.2.0 and remove it from their projects. Avoid executing code from untrusted or mutable third-party hosts, especially over unencrypted HTTP. Monitor for any updates from the package maintainers or security advisories for remediation guidance. Patch status is not yet confirmed — check the vendor advisory or official sources for current remediation guidance.