The 'gpu-accelerator' npm package versions 1.4.2 to 1.4.7 is a supply-chain malware threat. When integrated into a PostCSS pipeline, it decodes a 56 KB XOR-obfuscated JavaScript payload from a binary asset and executes it in a Node.js VM context with full privileges, including filesystem and network access. It includes a deliberate evasion check to avoid running in continuous integration environments, activating only on developer workstations. This behavior indicates a targeted supply-chain attack designed to compromise developer machines and potentially exfiltrate sensitive data or execute arbitrary code.

Systems with the affected 'gpu-accelerator' package installed are fully compromised, granting attackers full control over the host environment. This includes access to filesystem and network capabilities, enabling potential data theft, credential compromise, and further malware deployment. Removal of the package alone does not guarantee eradication of all malicious artifacts. Immediate rotation of all secrets and keys stored on the compromised system is required.

No official patch or fix is currently available. Immediate removal of the 'gpu-accelerator' package versions 1.4.2 through 1.4.7 is strongly recommended. Treat any system with this package installed as fully compromised. Rotate all secrets and credentials from a separate, trusted environment. Monitor for any signs of persistent malicious activity and consider full system reimaging if compromise is suspected.