The express-request-engine npm package (version 3.6.3) is a malicious package that disguises itself as a normalize-path utility. Upon loading, it calls an initialization function that fetches data from a mutable JSON document hosted on jsonbin.io. It extracts a field named 'cerookie' from the response and executes it as JavaScript code using the Function constructor, passing in the consumer's require function. This allows arbitrary attacker-controlled code to run with full privileges within the importing process. The external JSON resource is mutable and controlled by an anonymous account, enabling the attacker to change the executed payload at any time. The obfuscation in naming and the mismatch between advertised functionality and actual behavior indicate deliberate concealment rather than accidental misconfiguration.

Systems that have installed or are running express-request-engine version 3.6.3 are fully compromised. The attacker gains the ability to execute arbitrary code with full module-loading privileges, potentially leading to complete system compromise. All secrets and keys stored on the affected system should be considered exposed and must be rotated immediately. Removing the package alone may not be sufficient to eradicate the compromise, as the attacker may have installed additional malicious software.

Remove the express-request-engine package version 3.6.3 immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored or accessible on the compromised systems using a secure, unaffected environment. Conduct a thorough investigation and remediation of the affected systems to detect and remove any additional malicious software or persistence mechanisms. Patch status is not applicable as this is a malicious package rather than a vulnerability with an official fix. Avoid installing packages from untrusted or unknown sources and verify package integrity before use.