The 'cards-forms-debit-clone' npm package version 35.2.3 includes code that loads a shim script which dynamically downloads a platform-specific binary from anonymous *.workers.dev subdomains. The binary is saved to temporary storage with disguised filenames, permissions are set to executable, and it is spawned detached via shell commands. If the HTTPS download fails, a fallback mechanism uses DNS TXT record queries to a *.dl.wel1.ru domain to reconstruct a base64-encoded payload, which is then executed. No cryptographic verification of the downloaded or reconstructed payload is performed. This malicious behavior triggers on any import of the package, effectively enabling remote code execution under the guise of telemetry functionality.

This malicious package enables arbitrary code execution on any system that imports version 35.2.3 of 'cards-forms-debit-clone'. The downloaded binaries are executed without integrity checks, allowing an attacker to run arbitrary code with the privileges of the importing process. The fallback DNS-based payload retrieval further ensures persistence and evasion. This poses a significant security risk including potential system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented. Users should immediately avoid using version 35.2.3 of 'cards-forms-debit-clone'. Remove the package from all environments and replace it with a trusted alternative. Monitor for any signs of compromise on systems where this package was used. Check vendor advisories or npm security advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.