The core-js-gns npm package (version 1.0.0) includes a postinstall script that acts as a dropper. It first checks for developer-machine heuristics and a 24-hour skip marker, then exfiltrates hostname, username, platform, architecture, Node version, OS release, and package details to a malicious endpoint. Subsequently, it retrieves an AES-256-GCM encrypted payload from the same endpoint with TLS verification disabled, decrypts it using a hardcoded key, verifies the payload contains a specific string, writes it to a Python script in the user's cache directory, and executes it detached from the main process. This behavior enables arbitrary remote code execution on the installer's machine and is triggered during npm install. The package name mimics the legitimate core-js library to deceive users.

Successful installation of [email protected] results in exfiltration of sensitive system and user environment information to an attacker-controlled server. It also leads to execution of arbitrary code fetched remotely, allowing the attacker to run any code on the victim's machine with the installer's privileges. This can lead to full compromise of the development environment or build system where the package is installed.

Users should avoid installing the core-js-gns package version 1.0.0. Since no official patch or remediation is provided, the best mitigation is to remove this package from projects and replace it with the legitimate core-js package or other trusted dependencies. Verify package authenticity before installation and monitor for suspicious postinstall behaviors. Patch status is not yet confirmed — check vendor advisories or npm security advisories for updates.