The mcp-audit-sync-internal npm package at version 99.9.9 declares a preinstall script that runs 'node index.js'. On Windows, this script spawns a hidden PowerShell process which downloads a ZIP archive from an unrelated anonymous file hosting service (https://files.catbox.moe/5khq55.zip). The ZIP is extracted into the temporary directory, and an executable named Verification_Tool.exe inside it is launched. The remote artifact is neither pinned nor verified by hash or signature, and the entire fetch-and-execute process is hidden from the user via PowerShell's -WindowStyle Hidden option. This results in automatic arbitrary code execution on any Windows system that installs this package. The package's metadata and executable filename are deceptive, serving as cover stories inconsistent with the actual malicious behavior.

This malicious package enables arbitrary code execution on Windows hosts during npm install, potentially allowing attackers to run any code with the privileges of the installing user. The unverified and anonymous nature of the downloaded payload increases the risk of executing unknown and potentially harmful software. This compromises system integrity and security without user consent or awareness.

No official patch or remediation is currently available for this malicious package version. Users should avoid installing mcp-audit-sync-internal version 99.9.9. It is recommended to verify package authenticity before installation, avoid packages from untrusted sources, and monitor for suspicious preinstall scripts. Since this is a malicious package, removal and replacement with trusted alternatives is advised.