The 'cardsmobile-collection' npm package version 20.4.6 includes a malicious runtime script (_runtime.js) that triggers on require(). It downloads a platform-specific binary from multiple concatenated and obfuscated hostnames, using DNS-TXT record fallback to reconstruct the payload. The binary is saved to temporary locations on Unix or Windows systems, permissioned as executable, and spawned as a detached child process. The code dynamically assembles hostnames and module names to evade detection and pretends to be telemetry-related by checking environment variables. A sibling telemetry module contains dormant code with similar fetch and execution behavior. The binary payload is opaque and unrelated to the package's declared functionality, indicating malicious intent. The external domains used for payload delivery are not part of the official package infrastructure.

This malicious behavior allows arbitrary code execution on the host system when the package is required, potentially leading to full system compromise or unauthorized actions. The downloaded binary runs with the privileges of the executing process, which may facilitate further malicious activities. The obfuscation and dynamic assembly of hostnames and module names complicate detection and analysis.

No official patch or remediation is currently available for this package version. Users should immediately avoid using 'cardsmobile-collection' version 20.4.6 and remove it from their environments. Consider auditing dependencies for this package and replacing it with trusted alternatives. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.