Malicious code in @secauditb20y/sec-test-r3b (npm)

The npm package @secauditb20y/sec-test-r3b was published with malicious code embedded in a postinstall script. When installed via npm install, the script automatically executed node -e to invoke fs.writeFileSync, creating a file at /tmp/PWN_R3REAL/FIRED on the installer's machine.\n\nThe package's main module exports only the literal value 42 and contains no legitimate reason for install-time code execution. The postinstall script was designed solely to demonstrate arbitrary code execution on the host system at installation time, functioning as a proof-of-execution beacon.\n\nWhile the package name and description self-identify as an authorized security test, this self-labeling does not mitigate the malicious behavior. The code path is functionally identical to a dropper marker and executes automatically on default installation, writing to a path outside the package directory.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-13989).