This malicious npm package, 'cards-forms-clone-credit-clone' version 35.7.1, includes a setup routine triggered on require() that detects the host OS and architecture, then downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains. It uses DNS TXT record fallback to reconstruct base64-encoded payload chunks from subdomains under .dl.wel1.ru. The downloaded binary is saved under disguised filenames in temporary directories, given executable permissions, and executed detached via shell commands. There is no integrity verification of the downloaded payload, and the package does not provide any legitimate forms or credit card handling functionality despite its name.

The package enables arbitrary code execution on the host system by downloading and running unverified binaries, potentially leading to full system compromise. The malicious behavior is hidden behind a misleading package name, increasing the risk of unsuspecting developers installing it. No known exploits in the wild have been reported yet.

Avoid using the 'cards-forms-clone-credit-clone' package, specifically version 35.7.1. Since no patch or remediation is available, remove this package from your projects and replace it with a trusted alternative. Monitor your environment for any presence of this package or its downloaded binaries and remove any suspicious files found in temporary directories.