The 'vps-maintenance-paperclip-adapter' npm package version 0.1.2 is malicious. Upon import, it runs a top-level try block that (1) adds an attacker-controlled SSH ed25519 public key to authorized_keys for root and multiple standard users, (2) installs persistence via a per-minute crontab and a cron.d entry that beacon to 185.112.147.174:7007, and (3) immediately launches an interactive reverse shell to the same IP and port using a python3 fallback and bash TCP redirection. This occurs without any user interaction, granting the attacker full unauthenticated shell access and persistent control. The package disguises itself as a VPS maintenance adapter for Paperclip and instructs installation under a different name, consistent with impersonation tactics. Removal of the package alone may not eliminate the compromise due to persistent backdoors and root access.

Any system importing or running this package is fully compromised. The attacker gains unauthenticated root and user shell access, persistent remote access via cron jobs, and the ability to execute arbitrary commands. All secrets and keys on the compromised system should be considered exposed and rotated. The attacker can maintain long-term control and potentially move laterally or exfiltrate data.

No official patch or fix is available. The package should be immediately removed from all systems. Because the attacker gains root access and installs persistent backdoors, systems with this package installed should be considered fully compromised. All credentials, secrets, and keys stored on affected systems must be rotated from a secure, uncompromised environment. A full system rebuild or forensic investigation is recommended to ensure removal of all malicious artifacts.