@torbeck/heap is a malicious npm package designed to impersonate the legitimate @datastructures-js/heap package by copying its README and metadata. It exports the genuine Heap class to appear functional but appends a heavily obfuscated payload that, upon requiring the package, derives an AES key to decrypt a hidden URL. It then downloads a binary payload to the system temporary directory, writes lock and metadata files, sets executable permissions, and spawns the binary detached from the parent process. The payload includes platform-specific handling for Windows, Linux, and macOS. The downloaded binary's purpose is unrelated to heap data structures, indicating malicious intent. No version pinning or signature verification is performed on the downloaded binary, increasing risk. This is an install/require-time remote code execution (RCE) dropper delivered via typosquatting.

Users installing or requiring @torbeck/heap versions 4.3.10, 4.3.11, or 4.3.14 risk remote code execution on their systems. The package downloads and executes an unsigned, concealed binary payload with elevated control over the host environment. This can lead to system compromise, persistence, and potentially further malicious activity. The malicious code runs immediately upon require, increasing the risk of exploitation in automated build or deployment pipelines.

No official patch or remediation is currently available. Users should avoid installing or requiring the @torbeck/heap package, especially versions 4.3.10, 4.3.11, and 4.3.14. Verify package names carefully to avoid typosquatting attacks and prefer the legitimate @datastructures-js/heap package. Monitor dependency manifests and lockfiles to detect and remove any references to @torbeck/heap. Consider using package integrity verification tools and supply chain security measures to prevent installation of malicious packages.