The jsf-utils npm package (versions 1.3.1 and 0.3.1) includes a top-level asynchronous immediately-invoked function expression (IIFE) in lib/string/pathcase.js that fetches and executes a remote JavaScript payload from https://jsonkeeper.com/b/BPB86 using Function.constructor. This execution occurs with access to the installer's require function, allowing extensive control over the environment. The malicious code is concealed within a file intended as a trivial string helper, with the original benign code commented out. Additionally, the package spawns a detached Node.js child process running the fetched script, enabling execution persistence beyond the initial import. The package falsely claims to be authored by jonschlinkert and reuses legitimate metadata to disguise its malicious nature. Because the payload is hosted on a mutable anonymous paste service, the attacker can change the executed code at any time without republishing the package.

Any system that installs or runs jsf-utils versions 1.3.1 or 0.3.1 is fully compromised due to remote code execution with access to the installer's environment. This can lead to complete system takeover, including unauthorized access to secrets and keys stored on the machine. The malicious child process spawned by the package can persist beyond the initial execution, making removal of the package insufficient to guarantee system cleanup.

No official patch or fix is currently available. Immediate removal of the jsf-utils package versions 1.3.1 and 0.3.1 is strongly recommended. Because the package grants full control to an attacker, all secrets and keys stored on the affected system should be considered compromised and rotated from a different, trusted machine. Monitor for any suspicious child processes or unexpected network activity related to Node.js. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.