Installation mutates the system compiler path, replacing /usr/bin/gcc with the package executable. This can break builds and intercept broad gcc use.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install executes postinstall with permission to write /usr/bin.
Impact
Disrupts or controls subsequent system-wide gcc invocations; original compiler may be left unavailable if restoration fails.
Mechanism
system compiler replacement via rename, unlink, and symlink
Attack narrative
On install, the lifecycle hook tests write access to /usr/bin, renames the existing gcc binary to gcc.real, then removes any remaining gcc path and symlinks it to mcc. Later gcc invocations run the wrapper, which exits with an error unless its custom flow is used. Although the behavior is documented and has an uninstall restoration attempt, it is an unconsented install-time system-wide compiler hijack.
Rationale
The package performs a concrete, destructive system-wide executable replacement during postinstall. Its transparency reduces deception risk but does not remove the harmful install-time attack surface.
Evidence
package.jsonscripts/postinstall.jsscripts/preuninstall.jssrc/index.js/usr/bin/.mcc_test/usr/bin/gcc/usr/bin/gcc.real