The [email protected] package is a thin loader that pulls and executes the dependency fhirproxy-utils during npm install via preinstall and postinstall hooks. It impersonates OpenMRS REST tooling but is not affiliated with the official OpenMRS scoped packages. The package hijacks common developer tool command names by mapping them all to its malicious index.js, causing any invocation of these tools to execute attacker-controlled code. This leads to installer-side code execution at install time and persistent execution on subsequent tool usage, effectively compromising the host system.

Any system with [email protected] installed or running is considered fully compromised. The attacker gains persistent code execution on the host machine, potentially exposing all secrets and keys stored on the system. Removal of the package does not guarantee elimination of all malicious artifacts due to the level of control gained.

No official patch or fix is available. The package should be removed immediately from all affected systems. All secrets and keys stored on compromised machines must be rotated from a different, trusted system. Due to the full compromise risk, affected systems should be thoroughly audited and potentially rebuilt to ensure removal of all malicious components.