The 'cerebrum-core' npm package version 1.1.0 includes a postinstall hook that runs a 'setup.js' script. This script decodes an embedded base64 string into a tar.gz archive placed three directory levels above the package location (effectively the project root) and extracts its contents there, deleting the archive afterward. This behavior is unrelated to the package's advertised purpose and allows arbitrary file write/overwrite in the consumer's project directory at install time. The base64 payload is a placeholder in the analyzed sample, indicating a dropper template intended to be populated with malicious payloads before publishing. This mechanism enables full remote code execution on the affected system. The package's trivial main module and generic description further indicate it is a malicious supply-chain dropper rather than a legitimate utility.

Any system that installs or runs this package should be considered fully compromised. The malicious postinstall script can execute arbitrary code with the privileges of the installing user, potentially leading to full system compromise. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not remove all malicious artifacts or backdoors introduced by the dropper.

No official patch or fix is available. Immediate removal of the 'cerebrum-core' package version 1.1.0 is recommended. Due to the high likelihood of full system compromise, all credentials and secrets on the affected system should be rotated from a different, trusted machine. A full system forensic analysis and remediation may be necessary to ensure no persistent malicious components remain.