The [email protected] package runs a postinstall script that recursively scans the installer's home directory (Unix) or all mounted drives (Windows) for files matching credential-related patterns and uploads them to a hardcoded remote endpoint. Additionally, on Linux systems, it fetches an SSH public key from the same remote host, appends it to ~/.ssh/authorized_keys, changes ownership with sudo, and enables the firewall to allow SSH connections, granting persistent remote access to the attacker. The package masquerades as a backup/data-upload utility but performs supply-chain credential theft and backdoor installation.

Systems with [email protected] installed are fully compromised. Sensitive credential files may be exfiltrated, exposing secrets and keys. The attacker gains persistent remote access via an SSH backdoor, potentially allowing full control over the compromised host. Removal of the package alone does not guarantee eradication of all malicious artifacts or access.

Remove the [email protected] package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted device. Conduct a thorough investigation and remediation of the affected host, as the attacker may have established persistent access beyond the package installation. There is no official patch or fix available; avoid using this package version entirely.