The json-validator-utils package versions 1.0.0, 1.0.1, 1.1.0, and 1.1.2 include a malicious multi-stage dropper embedded in lib/core.js. The dropper triggers on calls to validateJson or validateXml functions, decoding an XOR-encrypted C2 URL that points to a GitHub-hosted manifest. This manifest provides platform- and architecture-specific payload URLs, which are downloaded to temporary directories and executed (using cscript on Windows, shell scripts on Linux/macOS). The malware delays execution until the system uptime exceeds 300 seconds to avoid detection in ephemeral environments. On Linux, it achieves persistence by writing a randomly named systemd user unit and enabling it; on macOS, it writes a LaunchAgents plist and loads it, ensuring the attacker-controlled code runs on startup.

This malicious package can execute arbitrary attacker-controlled code on the host system with persistence mechanisms, potentially leading to full system compromise. The delayed execution evades sandbox detection, increasing the risk of undetected infection. The persistence methods allow the malware to survive reboots on Linux and macOS systems. There is no indication of known exploits in the wild at this time.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove json-validator-utils versions 1.0.0, 1.0.1, 1.1.0, and 1.1.2 from their environments. Avoid using this package and audit systems for any signs of the described persistence mechanisms (random systemd user units or LaunchAgents plists). Monitor for unexpected network connections to the indicated C2 domains. Consider using trusted package sources and verifying package integrity before installation.