The 'path-addon' npm package (versions 1.0.2 through 1.0.7) is a typosquatting malicious package that mimics the legitimate Node.js 'path' module. It contains a remote code execution dropper that, upon requiring the module, decodes a base64-encoded URL pointing to an anonymous JSON paste service, fetches JavaScript code from that URL, and executes it via eval() without any integrity checks or version pinning. This allows an attacker to execute arbitrary JavaScript code in the context of any application importing 'path-addon'. The obfuscation and use of a mutable remote payload make this a clear attacker tool. The OpenSSF Package Analysis project confirms its malicious nature based on network communication and command execution behavior.

Any Node.js process that imports the 'path-addon' package will execute attacker-controlled JavaScript code fetched from a remote source at runtime. This can lead to remote code execution, potentially compromising the host environment, stealing data, or performing other malicious actions. The lack of integrity checks or version constraints means the attacker can change the payload at any time, increasing risk.

Users should immediately remove and avoid using the 'path-addon' package. Replace it with the official Node.js 'path' module or a trusted alternative. Since this is a malicious package, no official patch exists. Conduct audits of dependencies to detect and eliminate typosquatting or malicious packages. Monitor package sources carefully to prevent accidental installation.