The 'uzair-rajput-new' npm package masquerades as a color-gradient utility but embeds malicious code in its CJS main entrypoint. It reconstructs an AES-256-CBC key by XORing byte arrays from three sibling files with constants, concatenates the results, and derives a key via scryptSync with a fixed IV. This key decrypts a large base64-encoded payload, which is then executed dynamically using the Function constructor. The ESM entrypoint remains benign, indicating intentional concealment of malicious behavior in the CJS module. This design enables execution of attacker-controlled code with the privileges of the requiring process on every import.

Any system or developer that installs and requires the affected versions of this package will execute attacker-controlled code with the same privileges as the Node.js process. This can lead to arbitrary code execution, potential system compromise, data theft, or further malware deployment. The malicious payload is concealed and dynamically decrypted, evading static detection methods.

No official patch or remediation is currently documented. Users should immediately avoid using the affected versions of the 'uzair-rajput-new' package (=1.0.1, =1.1.0, =1.2.0, =1.3.0). Remove these versions from projects and replace them with trusted alternatives. Monitor dependency sources carefully and verify package integrity before installation. Check vendor advisories or trusted security databases for updates or patches.