The @tqm-mfe/main npm package at version 5.4.7 includes a malicious postinstall.js script that uses advanced obfuscation techniques to evade detection. Upon installation, it verifies the environment to avoid sandbox analysis, fetches a remote encrypted binary, decrypts and installs it persistently on the system, and executes it in a detached manner to maintain persistence beyond the npm process. Concurrently, it exfiltrates system metadata to a remote server. The package's public metadata falsely represents it as an internal corporate tool, consistent with a dependency confusion attack vector targeting organizations that might resolve the @tqm-mfe scope from the public npm registry. None of these actions are required for the purported API mocking middleware functionality.

This malicious package can lead to unauthorized code execution on the affected system, persistent installation of unknown binaries, and exfiltration of system information to an attacker-controlled server. This compromises system integrity and confidentiality. The obfuscation and sandbox evasion techniques increase the difficulty of detection and analysis.

No official patch or fix is currently available for this malicious package. The best mitigation is to avoid installing version 5.4.7 of @tqm-mfe/main from public npm registries. Organizations should audit their dependencies for this package and remove it if found. Use strict package source controls and consider implementing dependency allowlists or private registries to prevent dependency confusion attacks. Monitor for unexpected postinstall scripts in npm packages.