The 'nativescript-swisspost-pcc-creative-editor' npm package contains malicious code executed during the 'preinstall' lifecycle event. The package reads the installer's project directory name from the environment variable 'INIT_CWD' and sends this information with a timestamp to a hardcoded external callback URL. This behavior constitutes a dependency-confusion attack, allowing arbitrary code execution at install time and leaking sensitive project information. The package pretends to be an internal Swiss Post package but is malicious. The package version explicitly affected is 54.16.3.

Installation of this package results in arbitrary Node.js code execution on the installer's machine and disclosure of the installer's project directory name to an external attacker-controlled server. This compromises the confidentiality and integrity of the affected system. The vendor advisory states that any computer with this package installed should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different machine. Removal of the package alone does not guarantee full remediation due to potential persistent compromise.

No official patch or fix is available. The package should be immediately removed from all affected systems. All secrets and keys stored on compromised machines must be rotated from a separate, trusted device. Due to the severity of the compromise, affected systems should be treated as fully compromised and undergo thorough investigation and remediation beyond package removal.