The express-mocha-test package at version 0.0.1 declares a postinstall lifecycle hook that loads its main module, which performs a fetch request to an anonymous, attacker-controlled ngrok-free.app tunnel. The response body from this request is passed directly to eval(), executing arbitrary JavaScript controlled by the attacker on any system that installs the package. The package metadata falsely claims authorship by a well-known maintainer and misrepresents its functionality, indicating deliberate impersonation. This behavior results in complete compromise of affected systems, as attacker code runs with the privileges of the installing user.

Any system that installs [email protected] is subject to remote code execution by attacker-controlled code fetched during installation. This leads to full system compromise, including potential theft or manipulation of secrets and keys stored on the machine. The compromise is severe enough that simply removing the package does not guarantee removal of all malicious artifacts, necessitating secret rotation and thorough system remediation.

Remove the express-mocha-test package immediately from all affected systems. Rotate all secrets and keys that were stored or accessible on compromised machines from a secure, unaffected environment. Due to the nature of the compromise, assume full system compromise and perform comprehensive incident response and system remediation. No official patch or fix is available for this malicious package; avoid installing or using this package altogether.