The hatdhat-testkit npm package version 3.2.14 includes a middleware entrypoint (index.js) that launches a detached Node process (lib/caller.js). This process contains a fake process object with environment variables holding base64-encoded strings that decode to a remote URL, a request header name, and a secret key value. The package fetches a mutable JSON blob from the remote URL and executes the 'cookie' field of the response as JavaScript code using new Function.constructor with require() access. This grants the remote payload full Node.js capabilities, enabling arbitrary code execution unrelated to the package's advertised logging functionality. The obfuscation of the URL and header is intended to evade detection.

Successful exploitation allows an attacker to execute arbitrary code with full Node.js privileges on any system running the affected package version. This can lead to complete compromise of the host environment, data theft, or further malicious activities. The malicious behavior is hidden behind legitimate package functionality, increasing the risk of unnoticed compromise.

No official patch or remediation guidance is currently available. Users should immediately remove or avoid using hatdhat-testkit version 3.2.14. Monitor for updates from the package maintainer or npm registry for any official fixes or removals. Until then, do not install or deploy this package in any environment.