The 'auto-debug-tool' npm package versions 1.0.0, 1.0.2, and 1.0.3 includes a postinstall script that triggers a hidden PowerShell process on Windows to download and run an executable from an unverified source on GitHub. The downloaded binary's publisher does not match the npm package publisher, and no integrity checks are performed on the fetched executable. The malicious behavior is gated to avoid execution on non-Windows platforms and when NODE_ENV is set to development, with errors suppressed to conceal the activity. This design enables the payload to evade detection during development and activate only in targeted environments.

The malicious postinstall script can lead to arbitrary code execution on Windows systems during package installation, potentially compromising the host system. Because the executable is downloaded from a mutable and untrusted source without verification, it may be replaced or updated by the attacker at any time, increasing the risk of persistent or evolving malicious payloads. The concealment techniques reduce the likelihood of detection during development or on non-Windows platforms, increasing the chance of successful compromise in production or CI environments.

No official patch or remediation is currently documented. Users should avoid installing versions 1.0.0, 1.0.2, and 1.0.3 of 'auto-debug-tool'. Inspect package.json files for suspicious postinstall scripts, especially those invoking hidden PowerShell commands or downloading executables from untrusted sources. Consider removing or replacing this package with a trusted alternative. Monitor for updates from the package maintainer or vendor advisory for any official fixes or guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.