The 'evil-pkg' npm package declares a 'bin' entry that registers a shim script named 'node' in 'node_modules/.bin'. When this directory is prepended to the PATH, any invocation of 'node' during package installation runs the shim instead of the legitimate Node.js runtime. The shim writes a marker file and prints a hijack banner, demonstrating a fully functional code execution channel. This mechanism enables an attacker to run arbitrary code with the installer's privileges during installation lifecycle scripts. The package README explicitly markets this as a proof-of-concept for PATH-poisoning attacks and notes that real attackers could exfiltrate sensitive files like '.env', '~/.ssh', and '~/.npmrc'. This behavior constitutes a deliberate supply-chain attack vector. Versions 1.0.0 through 1.0.5 are affected.

Systems that install 'evil-pkg' versions 1.0.0 through 1.0.5 are at risk of unconsented code execution during package installation. This can lead to full system compromise, including unauthorized access to sensitive files and credentials. The attack vector hijacks the core 'node' runtime command, potentially affecting other packages and scripts during installation. Because the malicious code runs with the installer's privileges, attackers can gain extensive control over the affected system. Removal of the package alone may not fully remediate the compromise, and all secrets should be rotated from a secure environment.

No official patch or fix is indicated in the provided data. Users should immediately remove 'evil-pkg' versions 1.0.0 through 1.0.5 from their environments. Given the potential full compromise, all secrets and keys stored on affected systems should be rotated from a different, trusted machine. Monitor for suspicious activity related to package installations and avoid using this package. Since the package is malicious by design, do not trust any code or binaries installed alongside it. Patch status is not yet confirmed — check the vendor advisory or npm registry for updates.