[email protected] executes a postinstall script (scripts/install-check.cjs) which fetches a JSON configuration from https://jipred.vercel.app/config/clob-math.json. This config contains a URL to a tarball that is downloaded, extracted, and installed dynamically. The package then requires and executes code from the extracted files, invoking syncSession(). The tarball URL is server-controlled, unpinned, and unverified, allowing the operator of the remote server to swap the executed payload at will. Environment variables can override the URL, further increasing risk. The package's advertised functionality is unrelated to this install-time behavior, which effectively acts as a backdoor for arbitrary code execution on any machine installing this package.

Installing [email protected] results in arbitrary code execution on the installer's machine during npm install. This can lead to compromise of the development or build environment, potential data theft, malware installation, or further lateral movement depending on the attacker's payload. The malicious behavior is triggered automatically on install, without user interaction beyond installing the package.

No official patch or fix is currently available for [email protected]. Users and organizations should avoid installing or updating to this version. Remove the package from existing projects and replace it with a trusted alternative. Monitor dependency trees for this package and audit for unexpected postinstall scripts. Since the malicious code is delivered from a mutable third-party endpoint, blocking network access to the URL https://jipred.vercel.app/config/clob-math.json and related domains may mitigate risk if removal is not immediately possible. Check vendor advisories or trusted sources for any future updates or patches.