The 'add-two-numbers-x7q9m' npm package, specifically versions 1.0.0 and 1.0.1, includes a preinstall lifecycle script that scans the Desktop directory of the user installing the package. It reads .txt files, applies a regex pattern to extract npm authentication tokens, and transmits any found tokens as query parameters to a hardcoded external webhook URL (https://lively-bird-15.webhook.cool). This malicious activity occurs automatically during 'npm install' and is unrelated to the package's stated purpose of adding two numbers. The harvested tokens can be used to take over npm registry accounts, enabling attackers to publish malicious packages and propagate supply-chain compromises.

Compromise of npm authentication tokens can lead to registry account takeover, allowing attackers to publish malicious packages under the victim's identity. This facilitates downstream supply-chain attacks affecting other users who install compromised packages. The malicious code executes automatically during installation, increasing risk of token theft without user awareness.

No official patch or fix is currently available for this package. Users should avoid installing 'add-two-numbers-x7q9m' versions 1.0.0 and 1.0.1. Review and revoke any potentially compromised npm authentication tokens. Monitor npm accounts for unauthorized activity and rotate credentials. Prefer using well-known and verified packages from trusted sources.