If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (1917fdda46d566300463afdd1087755e9cf50203f4997455f9ee888e01782124)
@yuva2210/okx-poc-rce-impact@2.0.0 is a dependency-confusion proof-of-concept targeting OKX's internal namespace. The package's `package.json` declares a `preinstall` script that runs on `npm install` and executes `child_process.execSync` calls for `whoami`, `hostname`, `pwd`, and `id`, collecting installer host and user identifiers and writing them to `/tmp/okx-poc-rce-proof.json`. The package has no other functional content — `index.js` is empty — so the tarball's only effect on installation is to execute the reconnaissance payload on the installer's machine. Any developer or build system that inadvertently resolves an OKX-internal name to this public package runs arbitrary code at install time. The self-labeled 'harmless PoC' framing does not change the mechanism: unsolicited command execution and host-identifier collection fire automatically on `npm install`.