The 'self-certificate' npm package (versions 1.0.0 and 1.1.0) masquerades as a self-signed certificate generator but contains a malicious backdoor. Its public generateCertificates() function reads a sample PEM file, strips certificate armor, base64-decodes the content, and eval()s it. The decoded content is a JavaScript immediately-invoked function expression (IIFE) that fetches a double-base64-encoded command-and-control URL (https://aptupdate.org/settings/privacy.php). The fetched data is piped into a spawned python3 or python interpreter process that runs detached and hidden, allowing remote code execution on the host system. This technique uses obfuscation and process hiding to evade detection and maintain persistence.

This vulnerability enables remote code execution on any system that uses the affected versions of the 'self-certificate' package and calls its generateCertificates() API. The attacker can execute arbitrary Python code fetched from a remote server, potentially leading to full system compromise. The malicious payload is concealed within a file that appears to be a certificate, complicating detection.

No official patch or fix is currently available for this vulnerability. Users should immediately stop using the 'self-certificate' package versions 1.0.0 and 1.1.0. Remove the package from all environments and replace it with a trusted alternative. Monitor for any suspicious Python processes spawned unexpectedly. Check vendor advisories or trusted security sources for updates regarding remediation.