The bunnyhijack-test-0x00 npm package declares a 'bin' entry mapping 'node' to a shim.js script, causing npm to place a fake 'node' executable in node_modules/.bin. Since npm prepends this directory to PATH during lifecycle scripts, any sibling package invoking 'node' (e.g., esbuild) will execute shim.js instead of the real Node.js runtime. The shim.js currently writes a marker file and prints a banner, demonstrating the hijack. This hijack allows arbitrary code execution during npm install under the user's privileges. The package is a proof-of-concept for PATH poisoning, but the technique can be weaponized to run malicious payloads. The package depends on protoc-gen-grpc-web to trigger sibling lifecycle scripts invoking 'node'.

Any system that installs or runs this package is considered fully compromised because the hijack allows arbitrary code execution during installation under the user's privileges. This can lead to unauthorized access, data theft, or further malware installation. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure, unaffected system. Removing the package does not guarantee removal of all malicious artifacts or backdoors installed via this hijack.

There is no official patch or fix available for this package. The recommended mitigation is to avoid installing or running the bunnyhijack-test-0x00 package entirely. If the package has been installed, consider the system fully compromised: remove the package, rotate all secrets and keys from a different, secure machine, and perform a thorough incident response to identify and remediate any persistent malicious code. Monitor for any suspicious activity related to npm lifecycle scripts invoking 'node'.