The afisha-storybook-default npm package includes a malicious setup.js script that invokes a telemetry module to fetch obfuscated binaries from multiple attacker-controlled mirror hosts. These binaries are base64-decoded, saved under temporary directories with executable permissions, and launched via child_process. The package dynamically constructs domain names and API calls to evade static detection. It also generates an install fingerprint using host identifiers (hostname, username, current working directory, Node.js version, process ID) and sends this data to the dropper infrastructure. The package exports empty class methods, meaning its only effect is the remote fetch-and-execute behavior without any legitimate functionality. No integrity checks such as pinning, hashing, or signature verification are performed on the downloaded payloads.

Installing or requiring this package results in arbitrary code execution on the host system via remote binary download and execution. The attacker gains the ability to run platform-specific payloads with the permissions of the Node.js process, potentially leading to full system compromise. The collection and transmission of host fingerprint data also enables attacker tracking and targeted follow-up attacks.

No official patch or remediation is currently available for this malicious package. Users should immediately remove afisha-storybook-default from their dependencies and avoid installing or requiring it. Verify the integrity and provenance of npm packages before use, and consider using package allowlists or trusted registries. Monitor for any unusual child process executions or unexpected network connections to domains such as package-proxy.cf*.workers.dev and well1.site. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.