The solidity-testing-utils npm package (version 1.2.0) masquerades as a testing utility but includes a middleware factory that spawns a detached Node.js child process executing lib/caller.js. This script base64-decodes a hardcoded URL to an attacker-controlled JSON storage endpoint, performs an HTTP GET request with a hardcoded secret key header, and extracts a JavaScript payload from the response. It then executes this payload using the Function constructor with require access, allowing full arbitrary code execution in the context of the installer's Node.js process. The payload is mutable and can be changed by the attacker at any time, making this a supply chain malicious package threat.

This malicious package enables attackers to execute arbitrary code with full require access on any system that installs solidity-testing-utils version 1.2.0. This can lead to compromise of the host system, data theft, persistence, or further malware deployment. The attacker-controlled payload is dynamic and can be updated at will, increasing the risk and flexibility of the attack.

No official patch or remediation is currently documented. Users should immediately avoid installing solidity-testing-utils version 1.2.0 and remove it if already installed. Verify dependencies for this package and replace it with trusted alternatives. Monitor for any unexpected child processes or network requests to suspicious endpoints during npm installs. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.