The tsihealth-client npm package (versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3) contains a top-level self-decoding Immediately Invoked Function Expression (IIFE) that XOR-decodes a URI-encoded payload keyed on the function's own source code. This decoded payload is executed via eval() at module load time. The decoder includes anti-tampering logic that aborts execution if the source is modified. The package metadata describes it as a client for a remote control server that maintains a persistent connection to receive and execute commands. The exported provider function establishes a network-to-shell control channel, spawning a local ChildProcess shell that allows full command execution by whoever controls the remote server URL. This behavior constitutes malicious code embedded in the package, enabling remote code execution under the control of an attacker.

The malicious code enables an attacker controlling the remote server URL to execute arbitrary commands on the host running the tsihealth-client package. This results in a full remote shell with persistent network access, effectively compromising the host system. The impact includes unauthorized control, potential data theft, system manipulation, and further malware deployment. No known exploits in the wild have been reported, but the presence of such a backdoor represents a critical security risk.

No official patch or remediation guidance is provided for this malicious package. Users should immediately remove tsihealth-client versions 1.0.0 through 1.0.3 from their environments and avoid installing this package. Investigate any systems where this package was used for signs of compromise. Consider blocking the package from internal repositories and monitoring for attempts to install it. Since this is a malicious package, remediation involves removal and prevention rather than patching.