The npm package [email protected] includes a postinstall script that downloads a tarball from an untrusted remote JSON configuration URL, extracts it, runs npm install within the extracted directory, and then requires and executes a JavaScript module. This process occurs automatically during npm install, providing a direct remote code execution vector. The fetched payload is unpinned, unsigned, and unverified, making it a high-risk supply chain attack. The package's README claims it is an ASCII mascot library, but the actual code exports staking helpers unrelated to the advertised purpose, suggesting the malicious code is disguised as legitimate functionality.

Any system that installs [email protected] is vulnerable to remote code execution at install time, allowing an attacker to execute arbitrary code with the privileges of the installing user. This can lead to system compromise, data theft, or further malware deployment. The unverified and dynamic nature of the payload increases the risk and unpredictability of the attack.

No official patch or remediation is currently available. Users and organizations should avoid installing [email protected]. If already installed, remove the package and audit affected systems for compromise. Monitor vendor advisories for updates or fixes. Due to the nature of the threat, the safest mitigation is to not use this package version.