The 'dakumangalsingh' npm package declares a postinstall hook that runs a bundled Windows PE executable at install time. This executable is a jpackage wrapper loading an embedded Java JAR named virus.jar, which contains classes enabling remote command execution, screen capture, input synthesis via java.awt.Robot, and host fingerprinting. A replicate.bat script creates persistence by adding a shortcut to the executable in the Windows startup folder, ensuring the payload runs at each user logon. A cleanup.bat script is included to kill the process and delete the package folder recursively, facilitating anti-forensics. The package provides no legitimate library functionality and results in immediate arbitrary code execution and persistent compromise on Windows hosts.

Installing this package on a Windows system results in immediate arbitrary code execution with high privileges, persistent remote access via a command-and-control agent, screen capture and input synthesis capabilities, host fingerprinting, and the ability to remove traces of the infection. This compromises system confidentiality, integrity, and availability.

No official patch or remediation is currently available. Users should avoid installing the 'dakumangalsingh' package. Remove any installations of this package immediately and scan affected systems for persistence mechanisms and malicious artifacts. Monitor for suspicious startup shortcuts and unexpected executables in user application data folders. Since this is a malicious package with no legitimate functionality, blocking or blacklisting the package name in npm registries is recommended.