The @jacksher/install-exec-poc npm package version 1.0.0 and 1.0.2 includes a postinstall script that unconditionally performs network callbacks to an attacker-controlled OAST collector domain. This includes DNS lookups, HTTPS GET requests, and execution of shell commands via child_process.execSync to run curl commands. These actions disclose the installer's public IP and network metadata and establish a shell-to-network primitive on the host machine at install time. The package's malicious behavior effectively compromises the host system, potentially allowing full control by an attacker. The package is self-labeled as a proof-of-concept but is malicious in practice.

Any system that installs the affected versions of this package is considered fully compromised. The attacker gains network-level callbacks revealing the installer's IP and DNS resolver information and can execute arbitrary shell commands during installation. This can lead to complete system compromise, including unauthorized access to secrets and keys stored on the machine. Removal of the package does not guarantee removal of all malicious artifacts or backdoors introduced by the package.

Remove the @jacksher/install-exec-poc package immediately if installed. Rotate all secrets and keys stored on the compromised machine from a different, trusted system. Due to the potential for full system compromise, consider rebuilding the affected system from a known good state. No official patch or fix is available for this package; the vendor advisory does not exist. Exercise caution when installing untrusted npm packages and audit postinstall scripts.