The cardsmobile-data-utils npm package version 35.6.2 includes malicious functionality in its index.js and lib/telemetry.js files. Upon requiring the package, it downloads a native executable over HTTPS from hardcoded Cloudflare Workers domains with a DNS-TXT fallback to unrelated domains. The executable is saved under /var/tmp or %TEMP% with a randomized filename, permissions are set to 0755 on Unix systems, and it is executed detached via shell commands. No hash or signature verification is performed on the downloaded payload. The code uses string fragment concatenation to obfuscate hostnames and sensitive API calls, evading static analysis. The telemetry.js file (~81 KB) contains a similar download-execute chain disguised as an APM/telemetry SDK, providing a redundant staged payload delivery.

This malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, or further malware deployment. The lack of integrity checks on the downloaded executable increases the risk of supply chain attacks. The obfuscation techniques hinder detection by static analysis tools, increasing the likelihood of unnoticed compromise in environments that install this package.

No official patch or remediation is documented for this malicious package version. Users should immediately remove version 35.6.2 of cardsmobile-data-utils from their environments and avoid installing this package. It is recommended to audit dependencies for this package and replace it with trusted alternatives. Monitor for any unexpected processes spawned from temporary directories and investigate any suspicious activity related to this package. Since no patch is available, removal and avoidance are the primary mitigations.