Malicious code in tiny-folder-tree (npm)

The [email protected] package includes a postinstall script (src/build.js) that runs automatically during npm install. This script performs a DNS TXT lookup for spreadsheets-documents.com and checks if the first character of the first TXT record is '1'. If so, it invokes src/tools.js, which makes an HTTPS request to a dynamically reconstructed URL derived from obfuscated constants. The response header 'm' is passed directly to child_process.execSync, allowing arbitrary shell command execution controlled by an attacker. The code uses obfuscation techniques to evade static analysis, including reconstructing the HTTPS module require target and the destination URL. Additionally, the script bypasses execution on the author's host by checking for the username 'justin', confirming the malicious intent is to target other users.

This vulnerability allows arbitrary code execution on any system that installs [email protected], potentially leading to full system compromise, data theft, or further malware deployment. The attack is triggered during package installation, which is a common operation, increasing the risk of widespread impact if the package is used.

No official patch or remediation is currently documented. Users should avoid installing tiny-folder-tree version 0.1.0. If already installed, remove the package and audit affected systems for signs of compromise. Monitor official advisories for updates or patches. Since this is a malicious package, consider using package integrity verification tools and restrict installation of untrusted packages.