Malicious code in common-array-token (npm)

The 'common-array-token' npm package version 1.0.0 declares a postinstall script that runs 'node index.js'. This script reconstructs a URL from a numeric character array, which decodes to 'https://access-token-delta.vercel.app/'. It fetches JSON from this endpoint and passes the 'token' field to eval(), executing any JavaScript code served by the remote endpoint with the installer's privileges. The obfuscation of the URL conceals the destination from plaintext scanning. There is no legitimate reason for fetching and executing remote code in this manner during package installation, indicating malicious intent.

Any user installing the affected package version executes arbitrary JavaScript code controlled by the attacker with their user privileges. This can lead to compromise of the installer's environment, including potential data theft, system modification, or further malware installation. The impact is limited to users who install this specific package version.

No official patch or remediation is currently documented. Users should avoid installing 'common-array-token' version 1.0.0. Since the package fetches and executes remote code during installation, the safest mitigation is to remove or block this package from use. Monitor for updates or advisories from the package repository or npm for any official fixes.