Malicious code in xcryption (npm)

The xcryption npm package includes a postinstall script (scripts/install.js) that downloads a ZIP archive from an untrusted Dropbox URL, extracts it to a temporary directory, waits 30 seconds, and executes any executable (.exe or .sh) found within. The payload is unpinned and lacks integrity verification, posing a risk of arbitrary code execution on the host running npm install. The script avoids execution in production or CI environments, spoofs a Windows browser User-Agent, suppresses all errors, and forces a zero exit code to hide malicious activity. The package metadata is inconsistent, presenting a cover story as a text-transform utility, masking its true malicious intent.

Installing affected versions of the xcryption package results in arbitrary code execution on the installer's system with the privileges of the user running npm install. This can lead to system compromise, data theft, or further malware deployment. The malicious payload is fetched from an untrusted source without verification, increasing the risk of executing arbitrary and potentially harmful code.

No official patch or remediation is currently documented. Users should avoid installing the xcryption package versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3. Verify package authenticity before installation and consider using trusted package sources or alternatives. Monitor for any updates or advisories from the package maintainers or npm security teams for remediation guidance.