The express-mongo-santi package (version 1.1.9) contains a heavily obfuscated main file that, when loaded, performs a remote fetch-and-execute operation. It reconstructs a hardcoded IPv4 address at runtime, sends an HTTPS GET request to that address, and receives an encrypted payload. The payload is decrypted using AES with a key derived via crypto.scryptSync, then written to a file in the user's home directory and executed via child_process. The package name is a typosquat of express-mongo-sanitize, designed to trick users into installing it. This leads to arbitrary attacker-controlled code execution on the installer's machine with their user privileges.

Installing or importing express-mongo-santi version 1.1.9 results in arbitrary code execution under the installer's user identity. This can lead to full compromise of the user's environment, data theft, persistence, or further malicious activity depending on the payload fetched and executed.

No official patch or remediation is currently available. Users should avoid installing or importing the express-mongo-santi package. Verify package names carefully before installation to avoid typosquatting attacks. Use trusted sources and package integrity verification mechanisms such as checksums or signatures. Monitor for updates from the npm registry or security advisories for any official fixes or removals.