dexrelay@0.1.73

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Global npm installation on macOS.

A network client can execute commands with the installing user's environment and access.

postinstall persistence plus network-exposed arbitrary command spawning

On a macOS global install, postinstall invokes install.sh. The installer creates KeepAlive LaunchAgents and starts a bridge listening on all interfaces. Any WebSocket client can invoke local/exec, which passes its command array directly to spawn with the installer user's environment. This combines unconsented install-time persistence with a LAN-exposed arbitrary-command service.

The package performs concrete install-time persistence and exposes arbitrary command execution over a 0.0.0.0 WebSocket listener without source-visible authentication. Its platform/global guards limit reach but do not remove the exploit path.