Malicious code in text-transform-plus (npm)

The text-transform-plus npm package version 1.2.4 includes a postinstall script that downloads a ZIP archive from a hardcoded Dropbox URL to a hidden temporary directory. It extracts the archive and executes any .exe files found on Windows with hidden and detached flags. This behavior occurs during npm install, allowing arbitrary code execution on developer Windows machines. The script avoids execution when NODE_ENV=production or CI environment variables are set, aiming to evade sandbox and continuous integration detection. The package's declared functionality does not require downloading or executing binaries, indicating malicious intent. The downloaded binary is unpinned and unverified, increasing risk.

Arbitrary code execution on Windows developer machines during npm install of text-transform-plus version 1.2.4. This can lead to full compromise of the development environment where the package is installed. The malicious payload is delivered from an untrusted source without verification, increasing the risk of further malicious activity.

No official patch or remediation is currently documented. Users should avoid installing text-transform-plus version 1.2.4. Since the malicious behavior is triggered during npm install, refrain from using this package version. Monitor vendor advisories or npm security notices for updates or removal of the malicious package. Consider using alternative, trusted packages for text transformation needs.