The 'theme-color-picker' npm package, published by 'analysis-chart.io', contains a malicious payload in lib/picker.js that downloads an attacker-controlled encrypted binary from GitHub, decrypts it using XOR with key 0x42, base64-decodes it, verifies it as a Windows PE file, writes it to %APPDATA%/Microsoft/Windows with a randomized name, and executes it via rundll32. It establishes persistence by creating a scheduled task 'WindowsUpdateService' with highest privileges to relaunch the DLL at logon. Post-installation, it deletes its own files from node_modules and removes its dependency entry from the consumer's root package.json to conceal its presence. The malicious code is triggered automatically during npm install via the scripts.install hook. This results in full system compromise on Windows machines that install these package versions.

Installation of affected versions on Windows systems leads to execution of attacker-controlled native code with persistence and elevated privileges. The attacker gains full control over the compromised system. Secrets and keys stored on the system may be exposed. The package attempts to hide its presence by self-removal and manifest modification, complicating detection and remediation.

No official patch or fix is available. Users should immediately remove the affected package versions (=2.0.28, =2.0.30, =2.0.31) from their projects. Because the malicious payload establishes persistence and full system compromise is likely, affected machines should be considered fully compromised. It is strongly recommended to perform a full system forensic analysis and reinstallation from a trusted source. All secrets and keys stored on the compromised machine must be rotated from a different, secure device. Monitor for suspicious scheduled tasks named 'WindowsUpdateService' and remove them if found. Avoid using this package or any versions from the publisher 'analysis-chart.io'.