The 'decimal-format-core' npm package (versions 3.5.2 and 3.5.3) is part of a coordinated DeFi-themed infostealer campaign. Upon installation, its postinstall hook executes a script that fetches a JSON configuration from a malicious C2 domain, downloads a tarball containing a second-stage payload, installs it, and executes code that steals a wide range of sensitive credentials and data from the victim's environment. The fetched payload is neither pinned nor verified, allowing arbitrary remote code execution in the installer's context. The package attempts to appear legitimate by mimicking the description and keywords of a known logging library and framing the malicious fetch as an 'Enterprise sync' feature.

Successful installation of the affected package versions leads to arbitrary remote code execution during npm install, resulting in exfiltration of highly sensitive information including cryptocurrency wallet vaults, browser cookies and credentials, SSH keys, AWS credentials, npm tokens, Docker configuration, shell history, and password manager databases. This compromises the confidentiality and integrity of the victim's environment and assets.

No official patch or fix is currently available for this malicious package. Users should avoid installing 'decimal-format-core' versions 3.5.2 and 3.5.3. Verify package authenticity before installation, prefer well-known and trusted packages, and monitor for suspicious postinstall scripts. Since this is a malicious package rather than a vulnerability in legitimate software, removal and replacement with trusted alternatives is recommended. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.