The 'type-context' npm package masquerades as a logger but contains malicious code that executes arbitrary JavaScript fetched from hardcoded remote endpoints. Specifically, upon invocation of its middleware factory, it spawns a detached Node.js child process running 'lib/caller.js', which retrieves JSON data from an attacker-controlled URL. It extracts a 'cookie' field from the response and executes it as JavaScript code using the Function constructor with the Node 'require' function injected, granting full module loading capabilities. The package also uses obfuscated fallback URLs encoded in environment variables to evade detection. The remote code is mutable and hosted on anonymous paste services, enabling attackers to execute any code on the host machine. This results in a full compromise of any system running this package version.

Systems with the affected 'type-context' package versions installed are fully compromised, as the package executes attacker-controlled code with full Node.js module privileges. This can lead to unauthorized access, data theft, persistence of malicious software, and complete loss of system integrity. Secrets and keys stored on compromised systems are at risk and should be considered exposed.

No official patch or fix is currently documented. Immediate removal of the 'type-context' package versions 3.2.7, 3.2.8, 3.2.9, and 3.2.11 is strongly recommended. Because the package grants full control to attackers, assume the system is fully compromised and perform a comprehensive incident response, including secret and key rotation from a secure environment. Monitor for any persistence mechanisms or additional malware. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.