The node-array-plus package (versions 1.0.9 and 1.1.9) contains obfuscated malicious code that, upon being imported, constructs a hardcoded IPv4 endpoint and performs an HTTP GET request to retrieve an encrypted payload. This payload is decrypted using AES-256-CBC with a key derived from MD5 and an IV from the response, then written to a file in the user's home directory and executed via child_process with hidden windows and the working directory set to the home directory. The package has no legitimate API or exported functionality, indicating its sole purpose is to execute remote code on the installer's machine. The obfuscation techniques conceal the destination and the decrypt-drop-execute chain, complicating detection.

This malicious package can execute arbitrary code on the victim's machine with the privileges of the user running the Node.js process. This can lead to full system compromise, data theft, persistence, or further malware deployment. Because the code runs automatically upon import without user interaction, any project depending on these versions of node-array-plus is at risk of silent remote code execution.

No official patch or remediation is currently available. Users should immediately remove versions 1.0.9 and 1.1.9 of node-array-plus from their projects and avoid installing or importing this package. Audit dependencies for this package and replace it with trusted alternatives. Monitor for any unexpected files or processes originating from the user's home directory. Since the package is malicious by design, uninstalling and removing all traces is critical.