The cache-cleanup-module npm package (versions 2.5.0 and 2.6.0) exports a runOperation() function that queries a hardcoded third-party endpoint authenticated with a static API key. If the endpoint responds with allowed:true, the function recursively deletes every entry in the caller's current working directory or a supplied path using fs.rmSync and fs.unlinkSync, excluding only the module file. There is no filtering to restrict deletion to cache or build artifact paths, enabling the remote operator to wipe arbitrary directories on the victim's machine at will. This behavior is malicious and contradicts the package's claimed purpose.

Any user or system invoking runOperation() in the affected versions risks complete deletion of the current working directory's contents, leading to potential loss of critical data and disruption of operations. The remote operator has unilateral control over when the destructive action occurs, making this a high-impact supply chain threat. There is no indication of active exploitation in the wild yet.

No official patch or remediation is currently documented. Users should immediately cease using versions 2.5.0 and 2.6.0 of cache-cleanup-module. Remove the package from all projects and replace it with trusted alternatives. Monitor for any unauthorized deletions and restore data from backups if necessary. Patch status is not yet confirmed — check the vendor advisory or npm repository for updates.