[email protected] includes a postinstall script (install-check.cjs) that fetches a remote JSON configuration from a mutable URL (https://trabalhos-flax.vercel.app/config/clob-math.json). It downloads an attacker-chosen tarball, extracts it, runs npm install inside the extracted directory, then loads and executes a JavaScript module (peer-math.js) by invoking its syncSession() function. The fetched content is neither pinned, hashed, nor signature-verified, enabling arbitrary code execution on the installer's machine at install time. The package metadata is inconsistent and misleading, with the npm name, package.json description, README, and shipped files not aligning, preventing correct assessment by users. Additionally, the fetcher follows redirects without restriction and may downgrade HTTPS URLs to HTTP, increasing the risk of man-in-the-middle attacks on the downloaded payload.

Arbitrary code execution occurs on the system of anyone installing [email protected], as attacker-controlled code is fetched and executed during installation. This compromises the security and integrity of the affected environment. The misleading package metadata increases the likelihood of inadvertent installation by users who cannot accurately assess the package's intent or contents. The downgrade from HTTPS to HTTP during fetch adds a network-level attack vector via man-in-the-middle interception.

No official patch or remediation is currently documented for [email protected]. Users should avoid installing this version of the package. Verify package integrity and provenance before installation, and prefer packages with verified sources and pinned dependencies. Monitor vendor advisories or npm security notices for updates or fixes addressing this malicious package. Since this is a malicious package rather than a traditional vulnerability, removal and replacement with trusted alternatives is recommended.