The cursed-ecto-d3ab00 npm package is a malicious package designed to execute an install-time attack payload. Its lifecycle scripts (preinstall.js, install.js, postinstall.js, prepare.js) run a shell command that recursively scans multiple host filesystem paths for HTB{...} flag patterns, enumerates matching files and their contents, and collects environment variables, hostname, user ID, and present working directory. This collected data is base64-encoded and exfiltrated via HTTPS GET to a hardcoded Cloudflare quick-tunnel endpoint. Furthermore, the scripts send HTTP PUT requests to various internal hostnames and loopback ports targeting an API endpoint to register a malicious module named PWNED on adjacent services. This behavior triggers unconditionally on npm install. The package itself contains no legitimate code (index.js is empty) and exists solely to compromise the host.

Any system that installs this package is considered fully compromised. The attacker gains access to sensitive environment data, system identifiers, and potentially secrets stored on the host. The malicious code also attempts lateral movement by targeting internal services to register malicious modules, increasing the scope of compromise. Because the package runs code during installation, simply having it installed or running can lead to full system compromise. Secrets and keys on the affected system should be considered exposed and rotated immediately.

There is no official patch or fix available for this malicious package. The package should be removed immediately if found installed. Systems that have installed this package should be treated as fully compromised; all secrets and keys must be rotated from a separate, trusted environment. Due to the nature of the compromise, full system reimaging or restoration from a known good backup is recommended. Avoid installing untrusted or suspicious npm packages, and verify package legitimacy before use.