The ts-einkle npm package version 1.0.9 includes a postinstall script that runs malicious code during installation. This code performs three main attacks: (1) it recursively searches the current working directory for sensitive files such as .env, config.toml/json, and id.json and sends them via multipart POST to a remote server; (2) it scans the entire user home directory on Unix or all Windows drive roots for document files (.txt, .json, .env, .doc, .docx, .xlsx, .pdf, .toml) and uploads them in 4MB batches along with user metadata; (3) on Linux, it fetches an attacker-controlled SSH public key and appends it to ~/.ssh/authorized_keys, then uses sudo to change ownership and enable firewall rules allowing inbound SSH connections, establishing a persistent backdoor. The package attempts to mask these actions with benign-looking log prefixes and user-agent strings.

This malicious package compromises confidentiality by exfiltrating sensitive configuration and document files from the victim's system. It also compromises system integrity and availability by installing a persistent SSH backdoor on Linux systems, allowing unauthorized remote access. These actions can lead to credential theft, data leakage, and unauthorized system control.

No official patch or remediation is currently available for this malicious package. Users should avoid installing ts-einkle version 1.0.9 and remove it if already installed. Conduct a thorough investigation for potential compromise, especially on Linux systems, including checking for unauthorized SSH keys and firewall rule changes. Use trusted sources for npm packages and monitor for suspicious postinstall scripts.