The eth-codegen npm package version 0.5.4 advertises itself as an Ethereum code generation utility but contains unrelated mongoose leanhooks plugin code plus a hidden asynchronous function named runHandler. This function is appended after approximately 1KB of whitespace padding following the module.exports line. When the package is required, runHandler performs an HTTP GET request to https://www.jsonkeeper.com/b/VYFER, retrieves a 'cookie' field from the response, and executes it as JavaScript code via new Function('require', ...), passing the installer's require function. Since jsonkeeper.com is an anonymous, mutable paste host controlled by the attacker, this design enables arbitrary remote code execution in the context of the importing Node.js process every time the package is imported. The whitespace concealment and misleading package description are deliberate evasion techniques.

Any user or system that installs and imports eth-codegen version 0.5.4 is at risk of arbitrary code execution within their Node.js environment. This can lead to compromise of the host system, data theft, or further malware deployment. The malicious payload is remotely controlled and can be changed at any time by the attacker via the paste service, making the threat persistent and dynamic.

No official patch or remediation is currently documented. Users should immediately cease using eth-codegen version 0.5.4 and remove it from their projects. Avoid importing or installing this package. Consider using trusted and verified alternatives. Monitor for any unexpected network requests to jsonkeeper.com or similar domains from development or build environments. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.