fastify-addon is a typosquatting malicious package targeting users expecting fastify-plugin. Its package.json and README mimic the legitimate package to deceive users. Upon require, it executes a script that fetches a base64-encoded URL pointing to a JSON paste service, retrieves the 'content' field, and executes it with eval. Because the payload is hosted on a mutable third-party service, the attacker can change the executed code at any time, resulting in arbitrary code execution with full privileges in the consumer environment. This compromises the host system entirely.

Any process that requires fastify-addon will execute attacker-controlled code with full access to the environment, credentials, and filesystem. This leads to complete compromise of the affected system. All secrets and keys stored on the compromised system should be considered exposed and must be rotated from a clean environment. Removal of the package alone does not guarantee eradication of all malicious artifacts.

No official patch or fix is available. The package should be immediately removed from all systems. All secrets and credentials stored on affected systems must be rotated from a secure, uncompromised environment. Due to the full compromise risk, affected systems should be thoroughly audited and potentially rebuilt to ensure no persistent malicious code remains.