The helmet-pro package version 10.0.4 is a typosquat of the legitimate helmet HTTP-header middleware. Its package.json postinstall hook runs an obfuscated script that spawns a detached child process executing code fetched from a remote JSON bin (https://api.jsonbin.io/v3/b/6a719632da38895dfeb7128d). This fetched code is executed with access to Node.js require, allowing arbitrary remote code execution on the installer's machine at npm install time. The remote payload is attacker-mutable, enabling dynamic changes to the malicious code without republishing the package. The package metadata and comments attempt to masquerade as a nodemailer-adjacent SMTP module to disguise its malicious intent.

Installation of [email protected] results in arbitrary remote code execution on the installer's system, potentially compromising the system with attacker-controlled code. Because the payload is fetched dynamically from a mutable remote source, the malicious code can change at any time, increasing the risk and unpredictability of the compromise.

No official patch or fix is available for [email protected] as it is a malicious typosquat package. The recommended mitigation is to avoid installing helmet-pro and instead use the legitimate helmet package. Users should verify package names carefully before installation and consider using package integrity verification tools or npm security advisories to detect typosquatting. Removal of [email protected] from any environment where it was installed is advised.