Malicious code in @chnayser/server (npm)

The npm package @chnayser/server was found to contain malicious code in its dist/routes.js file. When the Express server is started via the advertised startServer or createApp entry points, it mounts a GET route at /api/update that executes a shell command via child_process.execSync.\n\nThe malicious handler fetches and executes a shell script from https://npm.nzeros.me/chnayser using curl and sh. This domain is unrelated to the package's declared publisher, indicating the package was compromised or intentionally published with malicious intent.\n\nThe /api/update endpoint requires no authentication and is framed as a health or update probe. The server binds to 127.0.0.1:4300 by default (configurable via a host option). Any client able to reach this address can trigger the malicious code execution, giving the attacker arbitrary remote code execution on the host running the server.\n\nThe fetched shell script content is mutable and controlled by the owner of npm.nzeros.me, allowing for persistent and evolving attacks. This incident was identified by the OpenSSF's malicious-packages project.