The cardsmobile-cardsmobile-core npm package version 35.6.6 includes a malicious dropper mechanism. Upon requiring the package, index.js loads a shim that selects a platform-specific payload path and downloads an unsigned executable from attacker-controlled Cloudflare Workers domains, with a DNS TXT chunked-base64 fallback from additional domains. The executable is saved under hidden paths such as /var/tmp or %TEMP% with decoy filenames, permissions are set to executable (chmod 0755), and it is spawned detached via shell commands (/bin/sh or cmd.exe). The package uses runtime string assembly to evade static detection and includes a base64-decoded payload executed from lib/telemetry.js. An environment variable check (DISABLE_TELEMETRY) exists but does not prevent the dropper from running. This behavior results in remote code execution on the host with persistence beyond the Node.js process.

Loading this package version results in remote code execution on the installer's host system. The malicious payload runs detached from the Node.js process, providing persistence and potentially full control over the affected system. This can lead to system compromise, data theft, or further malware deployment. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available for this malicious package version. Users should avoid installing or using cardsmobile-cardsmobile-core version 35.6.6. Remove any installations of this package from environments and verify that no unauthorized executables remain on the system. Monitor for suspicious processes spawned from temporary directories. Check vendor advisories or trusted sources for updates or official fixes.