The wellnpm package versions 2.0.9 through 3.0.2 include a 24MB ELF binary 'launch' that executes the XMRig Monero miner using RandomX and other algorithms. The package.json sets 'launch' as the main entry point and start script, causing immediate mining upon 'npm start'. A bundled config.json directs mining to pool.hashvault.pro with a hardcoded attacker wallet. A deploy script targets Android Termux by installing supporting libraries and shell wrappers to maintain miner persistence. The package masquerades as legitimate but is a cryptojacking dropper that fully compromises any system where it is installed or run.

Systems with any affected wellnpm versions installed or running are fully compromised, as the malicious miner runs with user privileges and can persist on the system. The attacker's Monero wallet receives all mined cryptocurrency. Because the package can install persistent components and execute arbitrary code, all secrets and keys on the compromised system should be considered exposed and rotated immediately. Removing the package may not fully remove all malicious components or backdoors.

No official patch or fix is available for this malicious package. The affected versions should be removed immediately from all systems. All secrets and credentials stored on compromised hosts must be rotated from a trusted environment. Monitor for and remove any persistence mechanisms installed by the package, especially on Android Termux. Exercise caution when installing npm packages and verify sources to avoid malicious modules.