The @equansservices/setup npm package includes a postinstall script that automatically runs on npm install. This script downloads a platform-specific archive over plain HTTP from a CloudFront URL, extracts it, and executes a binary (setup.exe on Windows or python3 setup.py on Linux) detached and hidden from the user. The package impersonates legitimate brands to deceive users. The downloaded payload is opaque, unpinned, and lacks any hash or signature verification, creating a risk of executing malicious code on the installer's machine. The affected versions are exactly 1.0.0, 1.0.1, 1.0.2, and 1.0.3. There is no vendor advisory or patch information available.

Installing any of the affected versions of @equansservices/setup results in execution of an unauthenticated, unsigned binary fetched over an unencrypted channel. This can lead to arbitrary code execution on the installer's system without their knowledge or consent. The malicious payload runs detached and hidden, increasing the risk of persistent compromise or further malicious activity. The package's impersonation of trusted brands may increase the likelihood of installation by developers seeking related tooling.

No official patch or remediation guidance is currently available. Users should avoid installing the @equansservices/setup package, especially versions 1.0.0 through 1.0.3. Verify the authenticity of packages before installation and prefer official sources. Monitor for any updates from the vendor or npm regarding remediation. Since the package fetches and executes code over plain HTTP without verification, blocking network access to the specified CloudFront URL may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.