progerss-cli is a malicious npm package designed as a typosquat of the popular cli-progress package. It sets its repository URL and author fields to mimic the legitimate package to gain trust. The package.json includes a postinstall script that runs build-helper.js, which waits for the form-data dependency to be resolved before loading an obfuscated ~273 KB payload (index.js). This payload collects data and exfiltrates it over HTTP using form-data. The obfuscation and delayed execution are intended to evade detection during installation. The package version 3.12.0 is affected. The presence of this package on a system indicates a full compromise, and all secrets and keys should be rotated immediately.

Any system with progerss-cli version 3.12.0 installed should be considered fully compromised. The malicious payload collects sensitive data and exfiltrates it over the network, potentially exposing secrets and credentials. Removal of the package alone may not eliminate all malicious artifacts or backdoors introduced by the attacker.

No official patch or fix is available. Immediate removal of the progerss-cli package version 3.12.0 is recommended. All secrets, credentials, and keys stored on the compromised system should be rotated from a secure, unaffected environment. Due to the likelihood of full system compromise, a thorough incident response and system rebuild may be necessary. Monitor for any signs of persistence or additional malware.