The 'npm-rce-poc' package version 1.0.13 includes a postinstall lifecycle script that, upon 'npm install', downloads a script from a hardcoded IP address (http://115.190.124.243:8761) without TLS or integrity checks and executes it immediately. On Unix systems, the script is piped to 'sh'; on Windows, it is saved as a batch file and executed. The package disguises itself as 'date-fns-lite', a lookalike of the legitimate 'date-fns' library, with a benign index.js to conceal its malicious behavior. This results in remote code execution controlled by the attacker on any system installing this package.

Any system that installs this package version is subject to remote code execution by the attacker controlling the hardcoded IP address. This leads to full system compromise, including potential theft or manipulation of secrets and keys. The compromise is severe enough that all credentials on the affected system should be considered compromised and rotated from a separate, secure system. Removal of the package alone may not eliminate all malicious artifacts or backdoors.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove version 1.0.13 of 'npm-rce-poc' if installed. Assume full compromise of affected systems and rotate all secrets and keys from a different, uncompromised system. Avoid installing packages from untrusted sources and verify package authenticity before installation. Monitor for any signs of persistent compromise beyond the package removal.