The caen-caen-core npm package (version 35.5.8) includes a malicious payload in its main entry point (index.js) and a secondary dropper in lib/telemetry.js. Upon require, it downloads OS-specific native binaries from obfuscated Cloudflare Workers URLs and fallback DNS-TXT base64-encoded addresses, writes them to temporary directories with deceptive names, sets executable permissions, and spawns them detached via shell commands. No hash or signature verification is performed on the downloaded binaries. Hostnames are dynamically reconstructed to evade static detection. The package falsely claims to provide telemetry functionality, which is used as a cover story. This behavior enables arbitrary code execution controlled by the attacker on any system using this package.

An attacker controlling the command-and-control infrastructure can achieve arbitrary code execution on any machine that installs or requires the affected version of the caen-caen-core package. This can lead to full system compromise, data theft, or further malware deployment. The lack of integrity checks on downloaded binaries and the use of obfuscation increase the risk and difficulty of detection.

No official patch or remediation is currently documented. Users should immediately stop using caen-caen-core version 35.5.8 and remove it from their environments. Avoid installing or requiring this package until a trusted, verified version is available. Monitor for any unusual processes spawned from temporary directories with deceptive names. Verify package integrity and source before installation. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.