The npm package [email protected] includes a preinstall lifecycle script that decompresses and writes a ~257KB Windows PE binary to the local app data directory, masquerading as conhost.exe. This binary is then executed in a detached, hidden manner. The embedded executable contains a kntrat section and references a known remote access tool repository and an IP address, indicating it functions as a persistent remote-access implant. This results in execution of an opaque, author-supplied binary on the host during npm install on Windows systems without user consent or legitimate purpose.

Installation of [email protected] on Windows systems results in silent execution of a malicious remote-access implant, potentially allowing unauthorized persistent access to the affected host. This compromises system integrity and confidentiality by running attacker-controlled code under the guise of a legitimate Windows process.

No official patch or remediation is currently documented. Users should avoid installing [email protected]. Review and remove the package if already installed and scan affected systems for the malicious conhost.exe implant located in %LOCALAPPDATA%\Microsoft\Conhost\. Monitor for suspicious network connections to the referenced IP address. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.