@krentzen/buffer-reverse version 1.0.3 is a malicious npm package that impersonates the legitimate buffer-reverse package by copying author and repository details as a cover. It embeds two large obfuscated IIFEs that execute upon require(), spawning a detached child Node process. This child process performs an HTTPS GET request with full redirect handling to download an unpinned, unsigned binary into the system temporary directory, sets executable permissions, and executes it detached from the parent process. This results in attacker-controlled native code execution on any system that imports this package.

Any Node.js project that requires @krentzen/buffer-reverse version 1.0.3 will execute attacker-controlled native code with the privileges of the Node process. The malicious code downloads and runs an unsigned binary, which can lead to full system compromise, persistence, and evasion of detection due to process detachment and obfuscation.

No official patch or remediation is currently available. Users should immediately remove and avoid using @krentzen/buffer-reverse version 1.0.3. Verify dependencies to ensure this malicious package is not included transitively. Consider using package integrity verification and lockfiles to prevent installation of malicious packages. Monitor for updates from the npm registry or security advisories for any official fixes or removals.