The [email protected] package declares a postinstall hook that runs a script enumerating network interfaces to obtain the MAC address, which it sends along with OS and path information to a remote server. It then performs a GET request to fetch JavaScript code from the server and executes it using Node's vm.runInContext with access to require, process, and Buffer, enabling arbitrary code execution. The package's integrity check is ineffective, comparing a constant string against itself, thus not verifying the fetched code. This introduces a malicious remote code execution vector during package installation.

An attacker controlling the remote server can execute arbitrary JavaScript code on the machine installing the package, potentially leading to full system compromise, data theft, or further malware installation. The malicious behavior occurs silently during installation, making it difficult to detect. This compromises the trustworthiness of the package and any projects depending on it.

No official patch or remediation is currently documented. Users should avoid installing [email protected]. Verify package authenticity before installation and consider using trusted alternatives. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation.