The friendly-greeter-demo npm package contains embedded malicious code that activates automatically via two mechanisms: a postinstall.js script that runs on npm install and respawns itself as a detached daemon, and an immediately invoked function expression (IIFE) in index.js that triggers on package import. Both mechanisms communicate with a hardcoded attacker-controlled IP (http://98.86.244.177:8080), registering the host and polling for shell commands to execute. Command outputs and host identifiers are exfiltrated over plain HTTP. This provides an attacker with arbitrary remote code execution on the affected system under the install user's privileges.

Any system that installs or runs friendly-greeter-demo is fully compromised, as the attacker gains arbitrary remote code execution capabilities. Host identifiers and command outputs are exfiltrated, potentially exposing sensitive information. The attacker can execute arbitrary shell commands, leading to complete system takeover. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a clean environment.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the friendly-greeter-demo package from all affected systems. Due to the nature of the compromise, full system remediation may require rebuilding the affected machines from trusted sources. All secrets and credentials stored on compromised systems should be rotated from a separate, secure environment. Monitor for any signs of persistent compromise or additional malware.