The [email protected] npm package includes multiple files exhibiting malicious behavior. The index.js file collects host identity data such as hostname, current working directory, and version, then serializes and transmits this data outbound. The spread.js file uses child_process and HTTPS requests to send host and process data externally. The c2_exfil.js file explicitly performs command execution to push content from the installer's environment to a remote git repository, facilitating self-propagation. These combined behaviors represent reconnaissance, exfiltration, and code propagation triggered upon installation or import, which are not consistent with legitimate development tools.

This malicious package can compromise the confidentiality of the host by exfiltrating system identity information. It also risks integrity and availability by executing commands that push code to remote repositories, potentially spreading malicious code further. The presence of such malware in a developer toolkit can lead to supply chain compromise and unauthorized data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or removal guidance is provided, users should avoid installing or using [email protected]. Conduct thorough environment scans for signs of compromise if this version has been installed. Consider removing the package and replacing it with a verified clean alternative.