The capacity-capacity-core npm package version 35.3.7 includes malicious functionality in its main entry point (_adapter.js). It downloads platform-specific native binaries from obfuscated Cloudflare Workers hosts or fallback DNS TXT base64-encoded URLs. The binaries are saved to temporary directories under disguised filenames, made executable, and executed asynchronously. Hostnames are dynamically reconstructed to evade static detection, and no hash or signature verification is performed on the downloaded payloads. This results in arbitrary native code execution on the host when the package is installed or imported.

This malicious package enables an attacker to execute arbitrary native code on the affected system with the privileges of the user running the Node.js process. This can lead to full system compromise, data theft, persistence, or further lateral movement depending on the environment and user permissions.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove capacity-capacity-core version 35.3.7 from their projects and dependency trees. Avoid installing or importing this package version. Verify the integrity and authenticity of npm packages before use and consider using trusted package sources or lockfiles to prevent supply chain compromise.