The 'normalize-path-seq' npm package (version 3.8.9) contains malicious code that, upon being required, performs an HTTPS GET request to a mutable external paste service URL. It retrieves JSON data containing a 'cookie' field, which is then executed as JavaScript code using the Function constructor with access to the installer's require function. This results in arbitrary code execution with full Node.js privileges on every import. The package is a typosquat of the legitimate 'normalize-path' package, mimicking its API and author metadata to deceive users. Because the payload is hosted on a mutable anonymous paste service, the malicious code can change dynamically without updating the package itself. This behavior effectively compromises any system that installs or runs this package.

Any system with 'normalize-path-seq' version 3.8.9 installed or running is fully compromised due to arbitrary code execution with full Node.js privileges. Attackers can execute any code, potentially stealing secrets, installing backdoors, or performing other malicious activities. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately. Simply removing the package does not guarantee removal of all malicious software introduced by the attacker.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove 'normalize-path-seq' version 3.8.9 from all systems. Treat any affected system as fully compromised and rotate all secrets and keys from a separate, trusted environment. Monitor for any signs of persistent malicious activity and perform a thorough incident response to identify and remediate any backdoors or additional malware.