The npm package [email protected] declares a preinstall hook that runs index.js. On Windows, this script spawns a hidden PowerShell window that downloads a zip archive from an unauthenticated anonymous file host (files.catbox.moe), extracts it to the %TEMP% directory, and launches Verification_Tool.exe. The download is unpinned and unverified, and the binary is opaque, indicating malicious intent. Because npm automatically runs preinstall scripts on every npm install, this leads to silent execution of attacker-controlled Windows executables on the installer’s machine, with concealment techniques consistent with a dropper rather than legitimate build steps.

This behavior allows remote attacker-controlled code to execute automatically and silently on Windows systems during npm install of the affected package version. The downloaded binary is unverified and could perform any malicious actions, potentially compromising the affected system. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is currently available. Users should avoid installing [email protected]. Verify package integrity and source before installation. Consider using package integrity verification tools and restrict execution of untrusted npm packages. Monitor for updates from the package maintainer or npm registry regarding remediation.