The kelly-sizing npm package versions 0.1.0 and 0.1.1 include a postinstall script (install-check.cjs) that fetches a JSON configuration from an attacker-controlled URL, which specifies a bundle URL. The script downloads a tarball from this URL, extracts it, runs npm install inside the extracted directory, then requires and executes a function from the extracted module. The external URLs are unpinned and unverified, allowing arbitrary code execution on the installer's machine during npm install. The package uses misleading variable names and references to disguise this behavior as a benign 'install check' or 'peer sync'. This behavior fully compromises any system where the package is installed or run.

Systems that have installed or run kelly-sizing versions 0.1.0 or 0.1.1 are considered fully compromised. Attackers gain arbitrary code execution on the affected machine with the privileges of the user running npm install. All secrets and keys stored on the compromised machine should be considered exposed and rotated immediately from a secure environment. Removing the package alone may not remove all malicious artifacts or backdoors installed by the attacker.

No official patch or fix is currently available. Users should immediately remove the kelly-sizing package versions 0.1.0 and 0.1.1 from their systems. Because the package executes arbitrary code during installation, any system that installed these versions should be treated as fully compromised. All credentials and secrets stored on the system should be rotated from a separate, secure machine. Monitor for suspicious activity and consider rebuilding affected systems to ensure complete remediation.