The [email protected] package declares a postinstall hook that runs a script enumerating network interfaces to obtain the host's MAC address and sends this data along with OS and path information to a remote server. It then fetches JavaScript code from the server and executes it in a Node.js VM context with access to require, process, and Buffer, enabling arbitrary code execution on the installer's machine. The package falsely claims to be a simple React Native UI component and does not perform any meaningful integrity checks on the downloaded code, making the system fully compromised upon installation.

Systems that install [email protected] are fully compromised due to arbitrary remote code execution during package installation. Attackers gain full control over the affected machine, potentially accessing all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious artifacts, as the attacker may have established persistent control.

Remove the react-native-ui-message package immediately from all systems. Rotate all secrets and keys that were stored or accessible on affected machines from a secure, uncompromised environment. Due to the severity and nature of the compromise, consider rebuilding affected systems to ensure complete removal of malicious code. No official patch or fix is available; avoid using this package entirely.