The 'cards-forms-credit-clone' npm package (version 35.9.5) includes a malicious payload where its index.js loads a _compat.js script that downloads a platform-specific binary from obfuscated Cloudflare workers.dev URLs constructed at runtime. The binary is saved to temporary directories with disguised filenames and executed detached via shell commands without any pinning, hash, or signature verification. The package uses evasion techniques including hostname fragmentation and DNS-TXT base64 fallback resolution from sdk.dl.wel1.ru. This behavior is disguised as 'analytics' or 'telemetry' but results in remote code execution under attacker control for any installer requiring this package.

Any system that installs or requires the 'cards-forms-credit-clone' package version 35.9.5 is vulnerable to remote code execution by an attacker. The malicious binary is downloaded and executed without integrity checks, allowing arbitrary code execution with the privileges of the installing process. This compromises system security and can lead to full system compromise.

No official patch or remediation is currently documented. Users should avoid installing or requiring the 'cards-forms-credit-clone' package version 35.9.5. Verify package integrity and source before installation. Consider removing this package if already installed. Monitor for updates from the package maintainer or npm registry for remediation guidance. Patch status is not yet confirmed—check the vendor advisory or npm security advisories for current remediation guidance.