The 'syncgrove' npm package version 1.4.0 includes a postinstall lifecycle script that contacts a hardcoded HTTP endpoint (http://player.sweeprovider.org) to retrieve an AES-CBC encrypted payload. This payload is decrypted locally using CryptoJS with a hardcoded key suffix and then executed via child_process.exec, resulting in execution of attacker-supplied shell commands during 'npm install'. The remote endpoint is unauthenticated and uses plain HTTP, making the payload susceptible to modification by attackers or man-in-the-middle adversaries. The package's README misrepresents its functionality as a trivial greeting module, concealing the malicious install-time behavior.

This vulnerability allows arbitrary code execution on the machine performing 'npm install' of syncgrove version 1.4.0. Because the payload is fetched over unencrypted HTTP from an unauthenticated remote server, attackers can modify the payload in transit or control the remote server to execute arbitrary shell commands. This can lead to full system compromise or further malicious activity on the affected system.

No official patch or fix is currently documented. Users should avoid installing syncgrove version 1.4.0. Since the package executes malicious code during installation, uninstalling or removing the package and scanning affected systems for compromise is recommended. Monitor the vendor or npm advisories for any updates or official remediation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.