The eslintcmd npm package (version 0.2.0) executes arbitrary code during installation via its postinstall script. This script fetches a JSON configuration from a mutable URL, downloads a tarball referenced therein, extracts it, runs npm install within the extracted directory, and executes a JavaScript file from the bundle. No integrity checks are performed on the downloaded content, allowing the package author to execute any code on the installer's machine. The package's declared functionality does not match this behavior, indicating malicious intent. This results in full compromise of any system where the package is installed.

Any system that installs eslintcmd version 0.2.0 is fully compromised, as arbitrary code execution occurs during installation. Attackers gain full control over the affected machine, potentially accessing all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious software introduced, necessitating secret/key rotation from a trusted environment.

Remove the eslintcmd package version 0.2.0 immediately. Rotate all secrets and keys stored on the compromised machine from a separate, secure system. Because the package executes arbitrary code during installation, full system compromise is likely; therefore, consider rebuilding or thoroughly auditing the affected system. No official patch or fix is available; avoid installing this package.