The 'index-ulid' npm package impersonates legitimate ULID libraries but contains a malicious postinstall script that acts as a cross-platform dropper. It copies a payload to a disguised directory and installs persistence via Windows scheduled tasks and registry keys, macOS detached processes, and Linux systemd user services or autostart entries. The payload is a 949 KB JavaScript file that runs a WebSocket-based command-and-control agent communicating with external APIs and Telegram. Both the dropper and payload include CPU count checks to evade sandbox environments. This package is a typosquatting lure designed to establish a persistent backdoor on developer and server machines.

Any system with this package installed or running is considered fully compromised. The attacker gains persistent remote access and control, potentially exposing all secrets and keys stored on the machine. Removal of the package alone does not guarantee eradication of the malicious software or backdoors installed. Immediate rotation of all credentials from a separate, trusted machine is necessary.

Remove the 'index-ulid' package immediately. Rotate all secrets and keys that were stored or used on the compromised machine from a different, secure system. Because the attacker may have established persistent backdoors, assume full compromise and perform a thorough incident response and system remediation. There is no official patch or fix; the package should be avoided entirely.