The 'squeez' npm package declares a postinstall lifecycle hook ('node install.js') that runs automatically on npm install. The install.js script imports modules such as child_process, fs, https, and os, and performs conditional logic based on the operating system. It reads the user's home directory, checks for the existence of certain files, and issues HTTPS GET requests to raw.githubusercontent.com URLs. This pattern enables install-time remote content fetch and execution combined with home-directory reconnaissance. Since the fetched content is from a mutable third-party source, it can be changed at any time without a new package release, increasing the risk of malicious code execution during installation.

This behavior allows an attacker controlling the content at the specified raw.githubusercontent.com URLs to execute arbitrary code on the victim's system during package installation. The reconnaissance of the user's home directory may expose sensitive information or enable targeted attacks. The use of mutable remote content as an execution source increases the risk of supply chain compromise and remote code execution at install time.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory or package repository for current remediation guidance. Until a fix is available, users should avoid installing the affected versions of the 'squeez' package or audit the postinstall script carefully before installation. Consider using package integrity verification or locking dependencies to known safe versions.