The 'testingsmthb1g' npm package version 1.0.0 includes a postinstall.js script that runs during npm install. This script decodes an XOR-obfuscated URL pointing to a Windows executable hosted on a personal GitHub repository unrelated to the package publisher. On Windows, it downloads and executes this binary detached from the install process. On WSL or virtualized Linux, it detects the environment and executes an XOR-decoded PowerShell command to run the same payload on the Windows host, effectively escaping the Linux sandbox. Concurrently, it sends a platform label to a hardcoded IP address using an obfuscated hostname. The payload delivery and command execution are obfuscated using XOR-encoded integer arrays reconstructed at runtime.

This malicious package enables arbitrary code execution on the host system during installation, potentially allowing an attacker to run unauthorized binaries and commands. The payload is downloaded from an untrusted source and executed with the privileges of the installing user. The script also leaks platform information to a remote IP address, which could aid in further targeted attacks or tracking. The sandbox escape technique on WSL/Linux increases the attack surface by compromising the Windows host from a Linux environment.

No official patch or remediation is indicated in the provided data. Users should avoid installing version 1.0.0 of the 'testingsmthb1g' npm package. Since this is a malicious package, the best mitigation is to remove it from any systems where it was installed and audit for any unauthorized activity. Monitor for similar malicious packages and rely on trusted sources for npm packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.