The 'wordpad-text-ui' npm package (versions 1.0.0 and 1.0.1) includes a postinstall hook that executes 'node main.js'. This script decodes an obfuscated URL stored as a reversed and Caesar-shifted string, retrieves a payload from this attacker-controlled URL via an HTTP GET request using axios, and executes the payload by writing it to the stdin of a detached node child process. The package contains no real functionality, with decoy files and an error in 'index.js' discouraging legitimate use. This behavior constitutes a classic install-time remote code execution dropper, enabling attackers to run arbitrary code on the victim's system. The package also pulls in a sibling package 'richtext-editor-ui' that propagates the same malicious campaign. Due to the attacker-controlled payload hosted on a mutable JSON paste service, the executed code can change at any time without updating the package.

Any system that installs or runs this package is at risk of full compromise. The attacker gains the ability to execute arbitrary code remotely during installation, potentially leading to complete control over the affected computer. All secrets and keys stored on the compromised system should be considered exposed and require immediate rotation from a secure environment. Removing the package alone may not eliminate all malicious artifacts or backdoors installed by the attacker.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove 'wordpad-text-ui' versions 1.0.0 and 1.0.1 from all systems. Assume full compromise of any system where this package was installed and rotate all secrets and credentials from a separate, secure machine. Avoid installing packages from untrusted or suspicious sources and verify package authenticity before use.