test-pkg-yarn@1.0.0

Analysis

test-pkg-yarn@1.0.0 shadows the node binary and runs a postinstall hook that executes shim.js. The script prints an educational warning explaining how a yarn postinstall can bypass the package manager's node-bin PATH protection, opens the GitHub research page hxxps://github[.]com/X3r0Day/BunnyHijack in a browser, launches a calculator, and writes a marker file to /tmp/.bun-npm-pwned. It makes no network calls to any remote host, reads no credential files (no .env, ~/.npmrc, ~/.ssh access), and performs no exfiltration of environment variables, tokens, or secrets.