The 'unsafe-malicious-package' npm package executes a postinstall lifecycle script that reads the installer's AWS credentials file located at ~/.aws/credentials and transmits the data unencrypted to a hardcoded external IP address (http://139.59.87.78:8765/listener). This exfiltration occurs automatically without user consent or opt-in. The package's stated functionality to print the current date/time is a decoy, and it employs evasion tactics such as prompt-injection content aimed at AI scanners and XSS payloads targeting registry user interfaces. Additionally, the package declares a self-referential dependency, which is an unusual pattern likely intended to manipulate the installation graph. Multiple specific versions of the package are affected.

Sensitive AWS credentials stored on the installer's machine can be stolen and transmitted to an attacker-controlled server, potentially leading to unauthorized access to AWS resources. The exfiltration occurs silently during installation, increasing the risk of compromise. The presence of evasion techniques indicates intent to bypass detection mechanisms, raising the threat level.

No official patch or remediation is currently documented. Users should avoid installing the 'unsafe-malicious-package' in any of the affected versions. Review and remove the package if already installed. Monitor for any unauthorized AWS activity and consider rotating AWS credentials if exposure is suspected. Since no vendor advisory or patch information is available, check trusted sources regularly for updates or official guidance.