Malicious code in js-soul (npm)

The 'js-soul' npm package (version 1.0.4) includes malicious functionality in src/api/session-api.js that reads a file '../../../../public/logo.ico' outside the package directory. It decrypts this file's contents using DES with a hardcoded key 'bf497c0b9cee', then spawns a detached Node.js child process, piping the decrypted code into the interpreter's stdin. This results in execution of arbitrary code at import time, despite the package's claim that no code runs on import. The use of an unrelated error string and the disguise of executable code as an image file indicate deliberate obfuscation. Any attacker-controlled code staged at the sibling path executes with the installer's privileges, posing a significant risk.

Arbitrary code execution occurs during package import, allowing attacker-controlled code to run with the privileges of the user installing the package. This can lead to full compromise of the install environment, including potential persistence, data theft, or further system compromise.

No patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory or npm repository for current remediation guidance. Until a fix is available, avoid using version 1.0.4 of 'js-soul' and consider removing it from your dependency tree.