The loading-sessions npm package (version 6.13.2) is a typosquatting malicious package that mimics the pino logger by exporting similar modules and filenames. When its middleware is invoked, it spawns a detached child process that base64-decodes a hardcoded URL disguised as an environment variable, fetches a JSON document from that URL, and extracts a 'cookie' string from the response. This string is executed as JavaScript code using the Function constructor with full access to Node's require function. The fetched code is attacker-controlled and mutable, allowing arbitrary code execution on the host. The package also decodes secret headers from disguised environment variables and retries fetching up to five times silently. This constitutes a classic remote code dropper hidden behind a typosquatting lure.

An attacker controlling the remote JSON payload can execute arbitrary code on any system that installs and runs the loading-sessions package version 6.13.2. This can lead to full compromise of the host environment, data theft, persistence, and further malicious activities. The malicious code runs with full Node.js require access, increasing the severity of the impact.

No official patch or fix is currently documented. Users should immediately stop using the loading-sessions package version 6.13.2 and remove it from their projects. Avoid installing packages that impersonate popular libraries, especially those not from trusted sources. Monitor package dependencies for typosquatting and malicious behavior. Check vendor advisories or trusted security sources for updates on remediation.