Malicious code in kelly-stake-sizing (npm)

The [email protected] npm package declares a postinstall script that downloads a JSON configuration from a remote URL, which is mutable by the package author. This JSON config points to a bundle URL from which a tarball is downloaded, extracted, and installed with npm install commands. The package then requires and executes a JavaScript file from the extracted bundle, invoking a function that runs attacker-controlled code with the privileges of the npm install process. Because the fetched code is not included in the original package tarball, is not version-pinned, and lacks hash or signature verification, this allows arbitrary code execution at install time. The package effectively acts as a backdoor, compromising any system that installs it.

Installing [email protected] results in arbitrary code execution with the privileges of the npm install process, leading to full system compromise. Attackers can execute any JavaScript code, install additional dependencies with their own lifecycle scripts, and potentially persist control over the affected system. All secrets and keys stored on the compromised machine are at risk and should be considered exposed.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove [email protected] from all systems. Because the package executes arbitrary code during installation, any affected system should be treated as fully compromised. All secrets and keys stored on the system must be rotated from a different, trusted machine. Monitor for any signs of persistence or additional malicious software resulting from the package installation.