The 'path-internal' npm package, which masquerades as a copy of the Node.js 'path' module, includes a malicious dropper inserted between standard path functions. Upon requiring the package, it decodes a base64-encoded URL pointing to a JSON document hosted on jsonkeeper.com, an anonymous mutable paste service. The package fetches this JSON and executes the 'content' field via eval(), allowing the attacker to run arbitrary code in the context of any process importing the package. A second similar payload is present but commented out. The use of obfuscation, misleading variable names, and typosquatting confirms deliberate malicious behavior. This was identified by Amazon Inspector and the OpenSSF Package Analysis project, which flagged the package for communicating with a malicious domain and executing commands associated with malicious activity.

Any system that installs and requires the 'path-internal' package versions listed is at risk of remote code execution due to the package fetching and evaluating attacker-controlled code at runtime. This can lead to full compromise of the host environment where the package is used. The attacker can change the payload at any time, making the threat persistent and dynamic.

No official patch or remediation is currently documented. Users should immediately remove and avoid installing the 'path-internal' package. Replace it with the official Node.js 'path' module or a trusted alternative. Monitor dependency trees for this package and block it in supply chain processes. Since the package fetches code from an external mutable source, network controls to block access to jsonkeeper.com may reduce risk. Check vendor advisories or npm security advisories for updates.