Malicious code in formatting-subtitles (npm)

The 'formatting-subtitles' npm package version 1.0.2 includes a preinstall script declared as 'sh ./prepare.js && exit 0'. Although prepare.js appears to be JavaScript, it is executed by /bin/sh, which does not recognize JavaScript comments. Inside a JavaScript-style comment block, shell command substitutions are executed: one sends a GET request to a hardcoded webhook URL leaking installation metadata, and another downloads a file from a GitHub Gist, extracts it using jq, writes it to disk as 'x', and executes it with sh. This results in the installer host executing arbitrary, attacker-controlled code fetched during installation.

This vulnerability enables remote code execution on any system that installs the affected package version. It also leaks installation metadata such as public IP and user-agent to the attacker via the webhook. The attacker can run arbitrary commands on the victim's machine during npm install, potentially leading to system compromise or further malicious activity.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.2 of the 'formatting-subtitles' package. Verify package integrity before installation and consider using trusted package sources or lockfiles to prevent automatic installation of malicious dependencies. Monitor vendor advisories for updates or official fixes.