@cy4dev/cydemo-bg-color versions 5.0.0 and 7.0.0 contain a malicious postinstall lifecycle script that runs automatically during npm install. This script uses node:child_process.exec to run two shell commands: one that collects AWS environment variables and POSTs them to http://localhost:8000, and another that opens the Calculator app on macOS. The credential exfiltration is limited to localhost in this version, but the presence of arbitrary shell command execution during package installation represents a significant security risk. The package falsely advertises itself as a DOM background-color helper, with no legitimate reason for these actions.

This vulnerability allows arbitrary code execution on the host system during package installation, potentially leading to credential exposure and unauthorized actions. Although the current exfiltration endpoint is localhost, the mechanism could be modified to send credentials externally. The execution of arbitrary shell commands can compromise the host environment, especially if AWS credentials are exposed, enabling further attacks or unauthorized cloud resource access.

No official patch or fix is currently available for this malicious package. Users should avoid installing versions 5.0.0 and 7.0.0 of @cy4dev/cydemo-bg-color. It is recommended to remove these versions from any projects and replace them with trusted alternatives. Monitor for updates from the package maintainer or npm advisories for remediation guidance. Since the package is not a cloud service, remediation depends on user action.