Malicious code in js-tokens-array (npm)

The 'js-tokens-array' npm package (versions 1.0.0 and 1.1.1) runs code at module load time that reconstructs a URL from an obfuscated numeric char-code array. This URL points to https://access-token-delta.vercel.app/, from which JSON data is fetched. The 'token' field of this JSON is then passed to eval(), causing arbitrary JavaScript code from the remote host to execute in the context of the Node.js process that imports or requires this package. This behavior constitutes a malicious package designed for remote code execution. The package name mimics the popular 'js-tokens' library, indicating a typosquatting attack vector.

Any user or system that installs or imports 'js-tokens-array' versions 1.0.0 or 1.1.1 will execute arbitrary JavaScript code delivered by a remote attacker, leading to remote code execution within the Node.js environment. This can compromise the security and integrity of the host system and any data accessible to the Node.js process.

No official patch or remediation is currently documented. Users should avoid installing or using the 'js-tokens-array' package, especially versions 1.0.0 and 1.1.1. Verify package names carefully to avoid typosquatting attacks and prefer the legitimate 'js-tokens' library. Monitor package sources and remove any instances of this malicious package from projects and dependency trees. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.