The 'o0o9' npm package in versions 1.8.0 and 2.0.1 includes a malicious payload that triggers execution of a PowerShell process via child_process.spawn at the top level of its main index.js file. This means that simply importing or requiring the package causes an unprompted PowerShell process to launch on the user's machine, representing an install-time code execution vector on Windows platforms. This behavior is not part of any legitimate API and is indicative of a malicious package designed to execute code without user consent.

Users who install or import the affected versions of the 'o0o9' package on Windows systems risk unprompted execution of PowerShell commands, which could lead to arbitrary code execution and compromise of the host system. This occurs without any explicit action by the user beyond importing the package, increasing the risk of silent compromise during development or deployment.

No patch or remediation information is currently available. Users should avoid installing or importing versions 1.8.0 and 2.0.1 of the 'o0o9' package. Verify the integrity and source of npm packages before use. Monitor vendor advisories or the npm repository for updates or removal of the malicious package. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.