The 'webpack-patch' npm package (version 1.1.7) is a malicious package impersonating the webpack ecosystem. Its main module spawns a detached child Node.js process that fetches JavaScript code from an anonymous mutable paste host (jsonkeeper.com). The fetched code is executed dynamically using the Function constructor, granting attacker-controlled code full Node.js privileges. The package uses base64-encoded environment variable keys to store command-and-control URLs and HTTP header information. The malicious payload includes retry mechanisms and fallback URLs to maintain persistence if the primary paste is removed. The package.json metadata is generic and misleading, designed to disguise the malicious intent. Any system running this package is at risk of full compromise.

Systems with 'webpack-patch' version 1.1.7 installed and executing its middleware are subject to arbitrary remote code execution with full Node.js privileges. This can lead to complete system compromise, including unauthorized access to secrets and keys. The attacker can maintain persistence through retry loops and alternate command-and-control URLs. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and rotated immediately. Removal of the package alone may not eliminate all malicious artifacts.

There is no official patch or fix available for this malicious package. The recommended mitigation is immediate removal of the 'webpack-patch' package version 1.1.7 from all affected systems. Additionally, all secrets and keys stored on compromised systems should be rotated from a secure, unaffected environment. Due to the high risk of full system compromise, a thorough security assessment and remediation process should be conducted. Monitor for any signs of persistence or additional malicious activity resulting from the package installation.