The 'http-uploader-dev' npm package declares a 'preinstall' script that uses the Bun runtime to execute 'index.js' during 'npm install'. This script detects the host OS and executes unrelated local calculator applications via synchronous shell commands, demonstrating an install-time remote code execution (RCE) capability. The package metadata is generic and suspicious, and the use of Bun as an alternate runtime fetched outside normal Node.js resolution matches known malicious patterns. Although the current payload is benign (launching calculator apps), the install-time execution vector allows attackers to replace the payload with arbitrary malicious code in future versions without changing the trigger. This results in a critical security risk for any system installing this package.

Any system that installs the 'http-uploader-dev' package executes attacker-controlled code during installation, leading to full system compromise. This includes potential unauthorized access, data theft, and persistent backdoors. The current payload is a proof of concept, but the attack surface allows arbitrary code execution at install time. Systems with this package installed should be considered compromised, and all secrets and keys on those systems should be rotated immediately from a trusted environment.

No official patch or fix is available for this malicious package. The package should be immediately removed from all systems. Because the package executes arbitrary code at install time, systems with this package installed should be treated as fully compromised. All credentials and secrets stored on affected systems must be rotated from a different, secure machine. Avoid installing untrusted or suspicious npm packages, and verify package authenticity before installation.