The 'node-cache-multithread' npm package (version 1.1.3) contains a ~23KB obfuscated JavaScript bundle that executes immediately upon require(). It uses Node.js modules such as fs, os, path, child_process, and an HTTP client to construct a hardcoded remote URL concealed within a large string array. The package fetches an encrypted payload, splits it into an initialization vector and ciphertext, decrypts it using a hardcoded key with crypto.createDecipheriv, writes the decrypted payload to a temporary file, and executes it with child_process.exec while hiding the window on Windows. The README falsely advertises the package as '@array-util/nodepull', misleading developers to install a differently named tarball that contains only the malicious dropper code. No legitimate caching or library functionality is present in the package.

This package poses a severe security risk as it executes arbitrary code fetched from a remote server on the victim's system. This can lead to full system compromise, data theft, or further malware deployment. The obfuscation and misleading package naming increase the likelihood of inadvertent installation by developers, amplifying the threat.

No official patch or remediation is currently available. Users and developers should immediately avoid installing or using 'node-cache-multithread' version 1.1.3. Remove any installations of this package from projects and systems. Verify dependencies and audit package sources carefully to prevent supply chain compromise. Monitor for updates from the npm registry or security advisories for any official remediation.