Malicious code in flydev (npm)

The flydev package (npm ecosystem) version 0.0.1 is a malicious package masquerading as a utility. Its exported function triggers 26 sibling modules that perform destructive operations on Windows systems: forced reboot via 'shutdown /r /f /t 0', recursive deletion of files on the C: drive using 'del /F /S /Q C:\*.*' and fs.unlinkSync, termination of critical OS processes (explorer, dwm, csrss) via wmic commands, memory exhaustion through unbounded array allocations, and a self-replicating fork bomb implemented by spawning hundreds of detached cmd and PowerShell infinite-loop processes. The package's structure and naming indicate deliberate deception with no legitimate functionality. Invocation results in filesystem destruction, critical process termination, and an unrecoverable reboot and process explosion loop.

If executed, this package will cause immediate and severe damage to the affected Windows host by deleting files recursively on the C: drive, terminating essential system processes, exhausting system memory, and causing continuous system reboots and process explosions. This results in system instability, data loss, and denial of service. The damage is destructive and unrecoverable without restoration from backups or system reinstallation.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing or executing the flydev package version 0.0.1. Security teams should block this package from their environments and remove it if already present. Since this is a malicious package with no legitimate functionality, do not invoke its exported functions. Employ standard supply chain security practices such as verifying package integrity and using trusted sources.