The [email protected] npm package executes a script named probe.js during installation that probes cloud instance metadata endpoints from AWS, Aliyun, Tencent, and others. It collects reachability data and environment details, then writes files named NCODE_META.txt and NCODE_POC_MARKER.txt into the current and parent directories, leaving beacon artifacts outside the package root. This behavior is unsolicited and unrelated to the package's advertised purpose, indicating malicious intent to perform environment reconnaissance and persistent marking on the host system.

This malicious behavior can lead to unauthorized information gathering about the host environment, specifically cloud metadata endpoints, which may expose sensitive instance details. The cross-directory file writes create persistent markers that could be used for tracking or further malicious activity. Although no direct exploitation or payload delivery is described, the reconnaissance and persistence actions pose a security risk by potentially aiding attackers in further compromise or lateral movement.

No official patch or remediation is currently available for [email protected]. Users should avoid installing this package and remove it if already present. Since this is a malicious package, the best mitigation is to audit dependencies carefully and use trusted sources. Monitor for the release of any vendor advisories or updates regarding this package for future remediation guidance.