The 'test-pkg-yarn' npm package declares a 'bin' entry that causes npm/yarn to symlink the 'node' command to a malicious script 'shim.js'. This hijack causes any invocation of 'node' resolved through the PATH to execute attacker-controlled code instead of the legitimate Node.js runtime. During installation, the package runs 'shim.js' via postinstall scripts, which executes OS commands unconditionally, including spawning calculator applications on Windows, Linux, and macOS, opening a URL in the user's browser, and creating a marker file in '/tmp'. The package self-identifies as a proof-of-concept named 'BunnyHijack PoC - yarn variant' and warns users of the PATH poisoning. While no data exfiltration is currently observed, the package compromises the developer environment by enabling arbitrary code execution and persistent command hijacking.

Any system that installs this package is subject to arbitrary code execution at install time and persistent hijacking of the 'node' command, which can lead to full system compromise. The package's behavior includes spawning OS processes and modifying the environment to redirect 'node' invocations to malicious code. According to the source, any computer with this package installed should be considered fully compromised, and all secrets and keys stored on that computer should be rotated immediately from a different machine. Removing the package does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is currently available for this package. The recommended mitigation is to avoid installing 'test-pkg-yarn' versions 1.0.0, 1.0.1, and 1.0.2. If already installed, remove the package and consider the system fully compromised. Rotate all secrets and keys from a separate, trusted environment. Monitor for any unauthorized changes or persistence mechanisms introduced by the package. Exercise caution when installing packages from untrusted sources, especially those that override common commands.