The candy-candy-core package version 35.2.7 includes malicious code embedded in its index.js and _polyfill.js files. Upon requiring the package, it constructs attacker-controlled hostnames and downloads a platform-specific binary via HTTPS. The binary is saved to temporary directories with decoy filenames (e.g., dotnet_diag_<hex>.exe on Windows) and made executable. The package then spawns the binary detached using shell commands (spawn("/bin/sh", ...) or spawn("cmd", ...)). It uses obfuscation techniques such as string-splitting of hostnames and function names, decoy filenames, and misleading telemetry comments to evade detection. Persistence is maintained via a lockfile named analytics_state. This results in remote binary execution triggered by a simple import of the package.

This malicious package enables remote code execution on any system that imports candy-candy-core version 35.2.7. The attacker-controlled binary can run arbitrary code with the privileges of the importing process, potentially leading to full system compromise, data theft, or further malware deployment. The obfuscation and persistence mechanisms increase the difficulty of detection and removal.

No official patch or remediation is currently documented. Users should immediately stop using candy-candy-core version 35.2.7 and remove it from their environments. Audit systems for the presence of the decoy binaries and the analytics_state lockfile. Consider blocking the identified attacker-controlled domains at the network level. Monitor for suspicious child processes spawned by node.js applications. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.