The 'pathfix' npm package (versions 3.0.10, 3.0.11, and 3.0.12) is a malicious package that pretends to be related to normalize.css but actually ships with a remote code execution gadget. On module load, it calls initPlugin(), which uses the 'request' library to fetch a configurable URL and evaluates the '.cookie' field of the response as JavaScript with full require access, allowing arbitrary code execution on the host machine. This function is also the main export, so any caller passing a URL triggers this eval path. Although the default URL is blank, the gadget runs automatically on require(), effectively compromising any system that installs or runs this package. The package metadata is deceptive, and the dependency list is unrelated to its stated purpose, aiming to increase installs. Systems with this package installed should be considered fully compromised.

Full remote code execution on the installer's machine, leading to complete system compromise. Any secrets or keys stored on the compromised system may be exposed and must be rotated. Removing the package alone may not eliminate all malicious artifacts due to the full control potentially granted to attackers.

No official patch or fix is available. Immediate removal of the 'pathfix' package versions 3.0.10, 3.0.11, and 3.0.12 is required. All secrets and keys stored on affected systems should be rotated from a secure, uncompromised environment. Treat any system with this package installed as fully compromised and perform thorough incident response and remediation.