The fastify-addon npm package is a malicious typosquatting package impersonating the legitimate fastify-plugin. It fetches attacker-controlled JavaScript code from a mutable third-party JSON paste service and executes it via eval at runtime. This allows arbitrary code execution with full access to the host environment, including credentials and filesystem. Any system requiring this package is considered fully compromised. Immediate removal and secret/key rotation are strongly advised.