The node-internal-svg-loader package, advertised as an SVG loader using well-known CDNs, contains hidden malicious functionality in versions 1.0.0 and 1.0.1. Functions getPlugin, setPlugin, and getPluginExten build requests to https://rest-icon-handler.store/icons/<token> and execute the returned JavaScript code via eval(JSON.parse(body)). This domain is not one of the advertised CDNs and is hardcoded in a non-obvious way. This results in arbitrary code execution on the consumer's Node.js process with full ambient credentials and filesystem access. The package also includes benign-looking code to disguise this behavior. Due to this, any system running this package is considered fully compromised.

Arbitrary code execution on the host system with full permissions, leading to total system compromise. Attackers controlling rest-icon-handler.store can execute any code, access all files, and potentially steal secrets or install persistent malware. The compromise is severe enough that all secrets and keys on the affected system must be rotated from a clean environment. Simply removing the package does not guarantee removal of all malicious artifacts.

Remove the node-internal-svg-loader package versions 1.0.0 and 1.0.1 immediately from all systems. Consider all affected systems fully compromised and perform a thorough incident response. Rotate all secrets and keys from a separate, trusted environment. There is no official patch or fix available; do not rely on partial remediation. Monitor for any signs of persistent compromise.