The 'test-pkg-pnpm' npm package (versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4) contains malicious code in its postinstall script 'node demo-clean.js' that executes automatically upon 'npm install'. This script performs two main actions: (1) it opens a GitHub repository in the default browser and spawns the OS calculator application as a demonstration of unauthenticated code execution; (2) it recursively deletes 'node_modules', '.pnpm', and related directories in all ancestor directories of the current working directory and the user's home directory using forced recursive removal, and rewrites package.json files to remove dependency entries. This behavior extends beyond the package's own directory, causing widespread filesystem damage and potential loss of project dependencies and environment stability. The malicious code also allows spawning arbitrary binaries, indicating potential for further exploitation. The package installation fully compromises the host system, requiring immediate secret/key rotation and system remediation.

Installation of the affected 'test-pkg-pnpm' package versions results in unauthenticated code execution on the host system, leading to destructive deletion of node_modules directories and related files across multiple directory levels including the user's home directory. This compromises the integrity of development environments and potentially the entire system. The malicious script also modifies package.json files to remove dependencies, disrupting project configurations. The system is considered fully compromised after installation, with potential for arbitrary code execution beyond the demonstrated calculator spawn. Secrets and keys stored on the compromised system should be rotated immediately from a separate, secure device.

There is no official patch or fix available for this malicious package. The package should be immediately removed from any affected systems. Due to the full compromise risk, all secrets and keys stored on the affected system must be rotated from a different, secure computer. Full system remediation or reimaging is recommended to ensure removal of any persistent malicious artifacts. Exercise caution when installing npm packages and verify package authenticity before installation.