The package @hkyyy/portal-widget-helper-0601 (version 1.0.0) is a malicious npm package that exports a trivial object but runs a postinstall script upon installation. This script executes system reconnaissance commands (whoami, id, hostname), captures the current working directory and Node.js version, and prints identifiable markers to stderr. It also contains code for data exfiltration via curl or wget to a DNS log URL, which is currently set as a placeholder string, disabling active exfiltration. The package is likely intended for dependency confusion attacks to fingerprint and compromise hosts that inadvertently install it. The presence of this package indicates a full system compromise risk.

Installation of this package results in execution of arbitrary system commands and potential data exfiltration, leading to full compromise of the affected system. All secrets and keys stored on the compromised system should be considered exposed and require immediate rotation. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the attacker.

Remove the package @hkyyy/portal-widget-helper-0601 version 1.0.0 immediately from all affected systems. Consider all systems with this package installed as fully compromised and rotate all secrets and keys from a secure, uncompromised environment. Investigate the system for additional persistence mechanisms or malware. There is no official patch or fix for this malicious package; remediation relies on removal and incident response.