The 'log-min' npm package (version 1.0.13) masquerades as a JavaScript library for the Theta Blockchain but is actually an impersonation of the Theta chain-sdk-js SDK. Its postinstall script executes a Node.js process that decrypts code from the 'thedata' dependency using a hardcoded password 'hydra' and runs it, allowing arbitrary code execution on any machine that installs or imports the package. This malicious behavior occurs both during 'npm install' via the postinstall hook and at runtime when the package is required. The executed code is not present in the 'log-min' tarball itself but originates from the separate 'thedata' dependency, giving the attacker full control over code execution on affected systems.

Any system that installs or imports 'log-min' version 1.0.13 is vulnerable to arbitrary code execution by the attacker controlling the 'thedata' dependency. This can lead to full compromise of the affected environment during installation or runtime, as the malicious code runs with the privileges of the user executing the npm commands or running the Node.js process.

No official patch or remediation is currently documented. Users should avoid installing or importing 'log-min' version 1.0.13. Verify package authenticity before use and consider removing this package from projects. Monitor vendor advisories for updates or fixes. Since the malicious code executes both at install time and runtime, uninstalling the package and auditing affected systems is recommended.