The trimprompt npm package versions 1.0.35, 1.0.42, 1.0.46, 1.0.47, 1.0.48, and 1.0.49 include multiple heavily obfuscated JavaScript files. Two obfuscated modules (sync.js and tracker.js) combine child_process usage with HTTP POST requests that transmit host and identifier information, suggesting host reconnaissance and outbound reporting to remote servers. Additionally, a postinstall.js script executes automatically on npm install, spawning PowerShell processes, and shims.js runs execSync with PowerShell commands, providing execution surfaces at install and load time on Windows. The obfuscation and behavior strongly indicate a malicious supply-chain payload rather than legitimate functionality. Concrete remote endpoints are hidden by string-array obfuscation and not recoverable from the provided data.

This malicious code can execute arbitrary PowerShell commands on Windows hosts during package installation and runtime, potentially allowing attackers to perform host reconnaissance and exfiltrate identifying information to remote servers. This compromises the security and privacy of affected systems and may facilitate further attacks or persistence. The presence of obfuscated code and outbound beaconing indicates a supply-chain compromise with significant risk to users installing these package versions.

No official patch or remediation information is provided. Users should immediately cease using the affected versions of trimprompt (1.0.35, 1.0.42, 1.0.46, 1.0.47, 1.0.48, 1.0.49). It is recommended to audit and remove these versions from environments and replace them with trusted alternatives or versions verified clean by the vendor or community. Monitor for unexpected PowerShell executions and network traffic to unknown endpoints on Windows hosts where these versions were installed. Check the vendor advisory for any updates on remediation.