The 'set-proto-chain' npm package (version 1.0.3) includes a malicious script in its index.js that decodes a base64 URL pointing to an anonymous mutable paste host. This URL is fetched via axios.get, and the response's 'data.cookie' field is executed by writing it to the stdin of a detached node child process. The execution path triggers automatically on 'npm install' due to a postinstall script and also on require(). The package impersonates the legitimate 'proto-chain' package to deceive users. Because the fetched payload is attacker-controlled and can change at any time, any system with this package installed is at high risk of full compromise.

Any computer with 'set-proto-chain' version 1.0.3 installed or running is considered fully compromised. The attacker gains remote code execution capabilities, potentially leading to complete system takeover. All secrets and keys stored on the compromised system are at risk and should be rotated immediately. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

There is no official patch or fix available for this malicious package. Immediate removal of 'set-proto-chain' version 1.0.3 from all systems is strongly recommended. All secrets, credentials, and keys stored on affected systems should be rotated from a secure, uncompromised environment. Consider rebuilding or thoroughly cleaning affected systems due to the high likelihood of persistent compromise. Avoid installing packages that impersonate legitimate ones and verify package authenticity before installation.