The 'route-processor' npm package version 3.1.5 exports a default function that dynamically constructs a URL to fetch JSON data from a remote host (https://svganchordev.net/icons/107). It then extracts a field from the response and executes it as JavaScript code with full Node.js privileges, including require and process access. The package includes dependencies (@primno/dpapi, better-sqlite3, sqlite3, node-machine-id) that facilitate decryption of browser-protected secrets, reading browser login data and cookies, and host fingerprinting. These dependencies serve no legitimate purpose for the advertised React helper functionality and indicate intent to harvest sensitive credentials from the victim's machine. The remote code execution vector is concealed by assembling the URL from split string constants to evade detection.

Any user or system running 'route-processor' version 3.1.5 and invoking its default export will execute attacker-controlled JavaScript code with full Node.js privileges. This enables arbitrary code execution, including reading sensitive browser data such as login credentials and cookies, decrypting protected secrets on Windows, and collecting host fingerprinting information. This compromises the confidentiality and integrity of the affected system and user data.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove 'route-processor' version 3.1.5 from their projects and dependency trees. Avoid installing or using this package version. Monitor for any updates or advisories from trusted sources regarding remediation. Since this is a malicious package, consider auditing your environment for potential compromise if this package was used.