path-extend @1.0.13

Summary

On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTBX) from jsonkeeper.com — an anonymous, mutable JSON paste host — and passes the returned data.content to eval(). A second loader fetches https://www.jsonkeeper.com/b/P0CND for the same purpose. Variable names ( randomStringRe , tokenStringRe ) and base64-encoded URLs are obfuscation to evade scanning. The package name typosquats Node's built-in path module; package.json lists an empty author field and a generic 'Node.js path module' description, while path.js is otherwise a verbatim copy of Node core's path.js with the malicious fetch+eval block injected. Any installer that require()s this package runs attacker-controlled JavaScript in their Node process, with content the attacker can change at any time by editing the paste.

Source: amazon-inspector (429c0dbb9c8395a6c87ffcf5e6ebe03c6cf6568b4bf205afa933b7d6a49aa578)