[email protected] includes a postinstall lifecycle script that fetches a JSON configuration from a non-publisher Vercel domain, downloads a tarball from a URL specified in that config, extracts and installs it, then executes code from the bundle. This process allows arbitrary code execution at install time. The package name and branding mimic the Polymarket CLOB ecosystem to deceive users. The fetched code is mutable, unhashed, and served from an unrelated domain, increasing risk. Installing this package results in full compromise of the host system.

Installing [email protected] leads to arbitrary code execution on the installer's machine, potentially allowing attackers full control. This compromises all secrets and keys stored on the system. The malicious code runs with the privileges of the user performing the install, enabling extensive system compromise and persistence. Removal of the package alone does not guarantee eradication of the attacker presence.

No official patch or fix is currently available. Users should immediately remove [email protected] from their environments. Any system that has installed this package should be treated as fully compromised. All secrets and keys stored on the affected system must be rotated from a separate, clean device. Monitor for any suspicious activity and consider rebuilding the affected system to ensure complete remediation.