The package @mgor/fw-canary-20260725-394b024b version 0.0.2 has a critical security issue where its main entry point (index.js) unconditionally runs a shell command that downloads and executes a shell script from a non-first-party domain (fewafw.hydege.me) via curl piped into bash. This allows any consumer of the package to execute arbitrary code on their host system without verification or pinning of the script, representing a severe supply chain risk. The package's metadata misleadingly claims no install scripts or functionality, masking the malicious behavior.

Any user or system that installs or imports this specific version of the package will execute arbitrary code fetched from an attacker-controlled domain, potentially leading to full compromise of the host environment. This is a direct arbitrary code execution vulnerability introduced via a malicious npm package.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing @mgor/fw-canary-20260725-394b024b version 0.0.2. Remove any existing installations of this package. Monitor for any unexpected network connections or shell activity related to this package. Consider using package integrity verification and supply chain security tools to prevent installation of untrusted packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.