The @mexc/shared-utils npm package version 1.0.0 includes a postinstall hook that runs automatically when the package is installed. This hook collects various host environment details and writes them to a local file in the temporary directory. The package was published to the public npm registry under the @mexc scope without evidence of legitimate scope ownership, indicating a dependency confusion attack vector. While the current payload only performs local data collection without network exfiltration, the attacker controls the code executed at install time and could update it to perform more harmful actions in the future. This creates a risk for any CI or build system that resolves the @mexc scope publicly and installs this package.

The immediate impact is limited to local collection of host metadata written to a temporary file during package installation. There is no current network communication or data exfiltration. However, the dependency confusion pattern allows the attacker to run arbitrary code at install time, which could be escalated in future versions to execute malicious payloads, potentially compromising CI/build environments that resolve this package from the public npm registry.

No official patch or fix is currently available. Users should avoid installing or resolving the @mexc/shared-utils package from the public npm registry, especially in CI/build environments. Verify ownership of the @mexc scope before trusting packages under it. Monitor dependency resolution configurations to prevent fallback to public registries for private scopes. Since the current payload performs only local writes, immediate risk is low, but caution is advised to prevent future malicious code execution.