The 'pkg-fallback' npm package (version 1.1.0) advertises itself as a string utility library but acts as a supply-chain dropper. Its package.json declares a dependency on 'native-bridge' sourced from an untrusted HTTP URL pointing to a bare IP address, which is unrelated to the publisher. Upon 'npm install', it downloads and installs this arbitrary tarball into the node_modules directory and executes lifecycle scripts. Additionally, a postinstall script downloads a second tarball over HTTP, saving it locally while suppressing errors. Neither download is pinned or hash-verified, and the contents do not justify the declared native dependency. This install-time behavior is a deliberate evasion technique to deliver malicious code through the supply chain.

The malicious package can execute arbitrary code during installation by downloading and running unverified payloads from an attacker-controlled server. This compromises the security of any environment that installs version 1.1.0 of 'pkg-fallback', potentially leading to unauthorized code execution and further compromise of dependent systems.

No official patch or remediation is currently documented for this package version. Users should avoid installing 'pkg-fallback' version 1.1.0. Verify package sources carefully and prefer packages with verified dependencies and secure download mechanisms. Monitor vendor advisories for updates or removal of the malicious package from npm registries.