The @equansservices/tool npm package version 1.0.2 includes a postinstall hook that fetches a platform-specific payload over plain HTTP from an anonymous CloudFront distribution. It extracts and runs this payload silently, executing aws.exe on Windows or a Python script on Linux, without any integrity checks or version pinning. The package falsely claims association with Equans and Anthropic Claude, misleading users. This behavior causes automatic execution of attacker-controlled binaries during installation, posing a direct compromise risk to affected systems.

Any environment that installs @equansservices/tool version 1.0.2 will automatically execute attacker-controlled code with the privileges of the installing user. This can lead to system compromise, unauthorized access, data theft, or further malware deployment. The lack of integrity verification and use of an unauthenticated HTTP source increases the risk of payload tampering or interception.

No official patch or fix is currently documented. Users should avoid installing @equansservices/tool version 1.0.2. Verify package authenticity before installation and prefer packages from trusted sources. Monitor for and remove this package if found in existing environments. Check vendor or repository advisories for updates or remediation guidance.