[email protected] is a malicious npm package that acts as a dropper. Its main script loads a bootstrap file that dynamically constructs URLs to fetch a platform-specific binary payload from Cloudflare Workers hosts, using runtime string assembly to evade static detection. It also uses DNS-TXT fallback domains to retrieve the payload. The downloaded binary is stored in temporary directories with misleading names, permissions are set to executable, and it is launched detached via shell commands. The package contains environment variable kill switches and a filesystem stamp file to control re-execution. The presence of this package on a system allows arbitrary native code execution controlled by an attacker, leading to full system compromise.

Any system with [email protected] installed or running is considered fully compromised. The attacker gains the ability to execute arbitrary native code on the host, which can lead to complete control over the system. All secrets and keys stored on the compromised machine should be considered exposed and must be rotated immediately from a secure, uncompromised environment. Removal of the package alone does not guarantee eradication of all malicious components or persistence mechanisms installed by the attacker.

No official patch or fix is available for this malicious package. Immediate removal of [email protected] from all affected systems is required. It is critical to assume full compromise of any host where this package was installed or executed. All credentials, secrets, and keys stored on the affected systems must be rotated from a different, secure environment. Conduct a thorough investigation and remediation of the affected hosts to identify and remove any additional malware or persistence mechanisms introduced by the attacker.