The cardsmobile-event-emitter npm package version 35.2.8 includes malicious functionality where its index.js script unconditionally loads a loader script that fetches a platform-specific binary over HTTPS from dynamically constructed Cloudflare Workers domains, with a DNS TXT fallback mechanism from suspicious Russian domains. The fetched binary is saved to temporary directories with obfuscated filenames, permissioned for execution, and launched detached via shell commands. The package does not verify the authenticity or integrity of the downloaded payload, and the malicious behavior is concealed behind the package's purported event emitter functionality. Additionally, the package tarball contains a second dropper script (lib/telemetry.js) exhibiting the same fetch and spawn behavior. This indicates deliberate malicious intent to execute arbitrary code on the host system.

This malicious package can execute arbitrary code on the host system by downloading and running an unverified binary from attacker-controlled infrastructure. This can lead to compromise of the host environment, including potential data theft, persistence, or further malware deployment. The lack of integrity checks and the use of obfuscated network communication channels increase the risk of undetected exploitation. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is currently available for this package. Users should immediately remove the cardsmobile-event-emitter package version 35.2.8 from their environments and avoid using it. It is recommended to audit dependencies for this package and replace it with a trusted alternative. Monitor for any unexpected execution of binaries from temporary directories and network connections to the listed suspicious domains. Since the package does not provide version pinning or integrity verification, strict supply chain security practices should be enforced to prevent installation of malicious packages.