Malicious code in @mexc/shared-utils (npm)

A malicious package named @mexc/shared-utils was published to the public npm registry under the @mexc scope without evidence of legitimate scope ownership. This represents a classic dependency-confusion attack vector.\n\nThe package includes a postinstall hook ("postinstall": "node postinstall.js") that executes automatically when installed by any resolver that falls back to the public registry when resolving @mexc-scoped packages. The postinstall script collects host metadata including hostname, username, process UID, current working directory, platform, Node.js version, and multiple npm environment variables (npm_config_registry, npm_config_user_agent, npm_execpath, INIT_CWD), writing this data to os.tmpdir()/mexc-poc-execution-proof.json.\n\nWhile the current version performs only local data collection with no outbound network calls, the attack demonstrates the install-time code-execution primitive available to an attacker who controls the package. The attacker can modify the payload in any future version to perform arbitrary actions, making this a critical supply chain risk for any CI/build system or development environment that resolves the @mexc scope publicly.\n\nThe incident was identified and reported by the OpenSSF malicious-packages project."