Malicious code in @lilsccott6x9/devpipe-connector (npm)

The npm package @lilsccott6x9/devpipe-connector was found to contain malicious code in its postinstall lifecycle script (scripts/setup.js). The package.json declared a postinstall hook that executed arbitrary shell commands.\n\nThe setup.js script stored base64-encoded shell command payloads in an object, with separate payloads for Windows (_m.w) and POSIX systems (_m.p). At runtime, these payloads were decoded using Buffer.from(s,'base64').toString('utf8') and executed via child_process.execSync, with branching logic based on os.platform() to dispatch to 'cmd.exe' on Windows or the default shell on Unix.\n\nThe decoded commands wrote a 'WebMCP-RCE-CANARY' / pwned.txt file to the installer's Desktop, demonstrating proof of arbitrary command execution on both Windows and Unix hosts at every npm install. The obfuscation of shell strings as base64 in a lifecycle script has no legitimate purpose in a package presenting itself as a CI/CD connector SDK; the mechanism is a general-purpose install-time RCE primitive.\n\nThe incident was identified by the OpenSSF malicious-packages project and credited to Amazon Inspector.