The loading-sessions package (version 6.13.2) impersonates the legitimate pino logger by exporting similar modules and filenames. When its middleware is invoked, it spawns a detached child process that base64-decodes a hardcoded URL disguised as an environment variable, fetches a JSON document from this URL, and extracts a 'cookie' string. This string is passed to a new Function constructor and executed with Node.js require access, allowing arbitrary code execution. The package retries fetching up to five times silently and uses base64-decoded headers from disguised environment variables. This is a classic remote-code dropper hidden behind a typosquatting lure.

This malicious package enables remote code execution on any system that installs and runs it, allowing attackers to execute arbitrary code with the privileges of the Node.js process. The attacker-controlled payload is fetched dynamically, making detection and prevention difficult once the package is installed and executed.

No official patch or remediation is currently available. Users should avoid installing or using the loading-sessions package version 6.13.2. Verify package authenticity before installation, prefer official packages, and remove any instances of this malicious package from your environment. Monitor for suspicious child processes spawned by Node.js applications. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.