Importing the package executes a remotely fetched shell payload. The header comment claiming inert behavior contradicts the executable code.
Static reason
No blocking static signals were detected.
Trigger
Any runtime require/import resolving main index.js.
Impact
Remote code execution with the privileges of the importing process.
Mechanism
curl remote content piped to /bin/bash via child_process.exec
Attack narrative
The main entrypoint runs automatically on import. It uses child_process.exec to fetch content from fewafw.hydege3.me with curl and pipes that content to /bin/bash, allowing the remote server to execute arbitrary commands on the consumer machine.
Rationale
The package has no install hook, but its exported main file creates concrete remote code execution whenever it is imported. The source comment falsely describes the package as inert.