Malicious code in js-array-tokens (npm)

The js-array-tokens package (version 1.0.2) includes a malicious payload that triggers on module import. It reconstructs a URL from a character code array to hide the destination endpoint (https://access-token-delta.vercel.app/). The package fetches a JSON response from this endpoint and executes the 'token' field content using eval(), allowing arbitrary remote code execution within the Node.js environment. This technique is a clear example of a remote-loader malware pattern designed to evade detection by obfuscating the URL and performing import-time code execution.

Any application importing js-array-tokens version 1.0.2 risks executing arbitrary code controlled by a remote attacker. This can lead to full compromise of the Node.js process, including data theft, system manipulation, or further malware deployment. The malicious behavior activates immediately upon module load, increasing the risk of unnoticed exploitation.

No official patch or remediation is currently documented. Users should immediately stop using js-array-tokens version 1.0.2 and remove it from their projects. Avoid importing this package until a trusted, patched version is released or the package is verified safe. Monitor for updates from the package maintainer or npm advisories for remediation guidance.