The cardsmobile-http npm package version 35.3.3 includes malicious functionality in its index.js file, which loads _ext.js. This script unconditionally downloads a platform-specific binary from hardcoded Cloudflare Workers URLs, using a DNS-TXT chunked fallback mechanism across *.dl.wel1.ru subdomains. The binary is written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, its permissions set to 0755, and then executed detached via shell commands (/bin/sh -c or cmd /c start). The host strings and child_process module names are obfuscated by runtime assembly from split arrays. Additionally, a sibling module lib/telemetry.js contains a similar dropper implementation with base64 chunk assembly and similar execution techniques, though it is not invoked from the current entry point. This behavior indicates the package is a malicious dropper designed to execute unauthorized binaries on the host system.

The malicious code results in unauthorized downloading and execution of binaries on the host system, potentially leading to full system compromise or further malicious activity. The dropped binaries impersonate legitimate diagnostic files, which may evade casual detection. This behavior poses a significant risk to any environment where this package version is installed and used.

No official patch or remediation is currently documented. Users should immediately avoid using cardsmobile-http version 35.3.3 and remove it from their environments. Since no fix is available, the best mitigation is to uninstall the affected version and avoid installing this package from untrusted sources. Monitor for any unexpected binaries or processes matching the described patterns and conduct forensic analysis if the package was used.