The 'test-pkg-x0' npm package declares a postinstall script 'shim.js' that executes unconditionally on npm install. This script branches based on the operating system and runs native commands such as launching the Calculator app and opening a GitHub URL in the default browser as proof-of-concept payloads. Additionally, the package.json registers a 'bin' entry named 'node' mapped to 'shim.js', which hijacks the 'node' command in environments like the bun package manager. This hijacking causes any dependency postinstall script invoking 'node' to execute the malicious shim instead of the legitimate Node.js runtime. The combined effect allows fully attacker-controlled arbitrary command execution on the installer's machine during installation and dependency resolution. The package versions 1.0.0 through 1.0.4 are affected.

Any system installing 'test-pkg-x0' versions 1.0.0 to 1.0.4 is fully compromised due to arbitrary command execution during installation. This includes direct execution via the package's own postinstall script and indirect execution by hijacking the 'node' command used by sibling dependencies. Attackers can execute any commands with the installer's privileges, potentially leading to full system compromise and exposure of all secrets and keys stored on the machine. Removal of the package does not guarantee elimination of all malicious artifacts or backdoors introduced.

No official patch or fix is currently documented. Users should immediately remove the 'test-pkg-x0' package from their systems if installed. All secrets and keys stored on affected machines should be considered compromised and rotated from a secure, unaffected environment. Due to the full compromise risk, affected systems should be thoroughly audited and potentially rebuilt. Monitor vendor advisories for any future remediation updates.