The 'mdb-vite' npm package's default export function 'getPlugin' performs an obfuscated HTTPS fetch to a remote URL, retrieving JavaScript code from the 'credits' field of the response. This code is then executed dynamically using 'new Function' with full Node.js context, including access to 'require', 'module', 'process', and other globals. This results in arbitrary remote code execution with the privileges of the Node.js process running the package. The package uses misleading metadata and naming to disguise its malicious intent. Any system running this package is effectively fully compromised.

Systems that install or run the 'mdb-vite' package are subject to arbitrary remote code execution by an attacker, enabling full system compromise. This includes potential credential theft, persistent backdoors, and further compromise of connected systems. The attacker gains the same privileges as the Node.js process executing the package, which can be extensive. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and rotated immediately.

No official patch or fix is available. The package should be immediately removed from all systems. Because the package executes attacker-controlled code with full privileges, any affected system should be considered fully compromised. All secrets, credentials, and keys stored on the system must be rotated from a secure, uncompromised environment. Additional forensic analysis and remediation may be necessary to ensure no persistent backdoors remain.