The express-ini package version 12.1.10 declares a postinstall script that runs 'node index.js'. The index.js file is heavily obfuscated using rotated string arrays and RC4-based decoders to hide its true functionality. Upon installation, it imports multiple Node.js modules including fs, os, path, crypto, child_process, and a network module. It installs silent handlers for uncaught exceptions and unhandled promise rejections to suppress errors. The script performs a remote lookup, processes the response by splitting on ':', base64 decoding, and AES decrypting it using crypto.createDecipheriv. The decrypted payload is written to a file in the current working directory and executed synchronously with child_process.execSync with windowsHide set to true. The package's README and name are deceptive, presenting it as a safe Express.js utility, but it is in fact a malicious dropper that enables remote code execution on the machine installing the package.

This malicious package enables remote code execution on the system of any user who installs version 12.1.10 of express-ini. The executed payload is fetched and decrypted at install time, allowing an attacker to run arbitrary code silently and potentially compromise the installer's environment. This can lead to full system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing express-ini version 12.1.10. Remove any installations of this version immediately and audit systems for signs of compromise. Use trusted package sources and verify package integrity before installation. Monitor for updates from the npm registry or security advisories for any official fixes or removals.