The 'express-enrouten-async' npm package is a supply-chain attack vector that mimics a legitimate package name to trick users into installation. Its package.json specifies a node-fetch dependency via a direct URL to a non-official registry, causing npm to fetch and install attacker-controlled code. This unpinned, mutable dependency allows arbitrary code execution within the host application. The package itself does not implement expected functionality but serves as a delivery mechanism for malicious code. This is a dependency confusion style attack leveraging a lookalike package name and a malicious remote dependency.

Any system that installs or runs 'express-enrouten-async' version 1.4.11 or 1.4.12 is fully compromised. The attacker gains arbitrary code execution capabilities through the malicious node-fetch dependency. This can lead to complete system takeover, exposure of secrets and keys, and persistent backdoors. Immediate secret rotation is required as compromise is assumed. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Remove the 'express-enrouten-async' package immediately from all systems. Rotate all secrets and keys from a secure, uncompromised environment. Because the attacker may have established persistent access, conduct a thorough incident response and system integrity verification. There is no official patch or fix; the package itself is malicious. Avoid installing packages from untrusted or unknown sources and verify package authenticity before installation.