The bpm-foundation-feature-flags npm package version 20.4.2 includes a malicious bootstrap routine triggered on require. It fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints, writing it to temporary locations on the host system and executing it detached via shell commands. To evade static analysis, hostnames are dynamically constructed from split string fragments. If HTTPS fetching fails, the payload is reconstructed from base64 chunks served via DNS TXT records under sequentially named subdomains. No signature or hash verification is performed on the fetched binary, which is unrelated to the package's declared purpose of feature flags management. This behavior indicates a supply chain attack embedding malicious code within a legitimate npm package.

Systems that install and run bpm-foundation-feature-flags version 20.4.2 risk executing an unverified, potentially malicious binary fetched from attacker-controlled infrastructure. This can lead to unauthorized code execution on affected hosts, potentially compromising system integrity and confidentiality. The malicious binary masquerades as a Microsoft diagnostic tool and is executed with minimal user visibility, increasing the risk of stealthy compromise.

No official patch or remediation guidance is provided in the available data. Users should immediately cease using bpm-foundation-feature-flags version 20.4.2 and remove it from their environments. Investigate and audit systems for signs of compromise related to this package. Monitor for updates or advisories from the package maintainers or npm registry regarding this incident. Avoid installing packages from untrusted sources and verify package integrity before use.