Malicious code in cache-poisoning-pwn-demo (npm)

The npm package cache-poisoning-pwn-demo was published with malicious code embedded in its postinstall hook and main entry point. The postinstall hook executes node -e \"try { require('./dist/postinstall.js'); } catch(e) {}\", which loads a bundled poisoned is-number module containing a top-level IIFE that unconditionally calls child_process.exec with platform-specific commands: open -a Calculator on macOS, calc.exe on Windows, and gnome-calculator/xcalc on Linux.\n\nThe same malicious IIFE is present in dist/index.js (the package's main entry point), meaning any consumer that requires or imports the package will also trigger arbitrary command execution. The package self-identifies as a supply-chain attack demonstration.\n\nWhile the current payload only spawns a calculator application, the underlying mechanism is a fully functional install-time and import-time arbitrary-command executor. Any installer running npm install or any downstream library that transitively requires this package will execute the hardcoded command in the installer's security context, demonstrating a real attack primitive.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.