Malicious code in @lilsccott6x9/devpipe-connector (npm)

The @lilsccott6x9/devpipe-connector npm package version 1.0.0 includes a postinstall script (setup.js) that decodes base64-encoded shell commands and executes them using child_process.execSync. The script differentiates between Windows and POSIX platforms, running commands via 'cmd.exe' on Windows or the default shell on Unix. The executed commands create a 'WebMCP-RCE-CANARY' or pwned.txt file on the Desktop, serving as a canary to prove arbitrary command execution during npm install. This mechanism constitutes an install-time remote code execution (RCE) vulnerability embedded as malicious code, not a legitimate installation step.

This malicious postinstall script enables arbitrary command execution on the host system during package installation, potentially allowing an attacker to execute any commands with the privileges of the user running npm install. While the current payload is a proof-of-concept canary file creation, the underlying mechanism could be exploited to run harmful commands, leading to system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.0 of @lilsccott6x9/devpipe-connector. Verify package integrity before installation and consider using trusted package sources or alternatives. Monitor for vendor advisories for any updates or official fixes. Since this is a malicious package, removal and blocking of the package from internal registries is recommended.