The yakuza0 npm package (versions =2.23.40 and =2.23.40-beta.3) includes malicious code embedded in cli/index.js and other files that bind outbound network calls to a hardcoded domain (https://registry-pxnpm.rdc.nfjbill.ren), which is not an official npm registry or publisher domain. The code performs runtime environment fingerprinting using process.versions, and executes shell commands via child_process combined with curl-based HTTP POST/GET requests to attacker-controlled endpoints. These actions occur in top-level module code paths, not user-invoked APIs, suggesting installer-targeted exfiltration and remote command execution capabilities.

This malicious code can lead to unauthorized data exfiltration from the host environment and potentially allow remote command execution. Because the code runs automatically upon module load, it can compromise systems using these specific yakuza0 package versions without user interaction. The hardcoded attacker-controlled endpoint and shell execution increase the risk of persistent and stealthy compromise.

No official patch or remediation information is provided in the source data. Patch status is not yet confirmed — check the vendor advisory or npm registry for current remediation guidance. Until a fix is available, avoid using the affected versions (=2.23.40 and =2.23.40-beta.3) of the yakuza0 package and consider removing or replacing them with trusted versions or alternatives.