The cardsmobile-notifications npm package (version 35.7.6) includes a malicious payload that, upon require(), loads a support script which fetches an OS/arch-specific executable from a rotating set of obfuscated Cloudflare Workers endpoints. It also uses a DNS TXT record covert channel fallback to assemble a base64-encoded payload from numbered subdomains. The payload is saved to temporary directories with disguised filenames, permissions are set to executable, and it is spawned detached via a shell command. No hash or signature verification is performed, and the command-and-control hostnames are dynamically assembled to evade detection. Additionally, a secondary module lib/telemetry.js contains similar malicious code but is not currently activated. This behavior indicates a supply chain compromise with remote code execution capabilities.

This malicious code enables remote code execution on systems that install and run the affected package version. The downloaded executables run detached and without integrity checks, allowing attackers to execute arbitrary code persistently. The use of obfuscated endpoints and covert DNS channels complicates detection and blocking. The presence of a dormant secondary module suggests potential for future activation of additional malicious functionality.

No official patch or remediation guidance is currently available for this malicious package version. Users should immediately remove version 35.7.6 of cardsmobile-notifications from their environments and avoid installing it. Monitor for updates from the package maintainer or npm security advisories for any official fixes or removal of the malicious code. Consider scanning existing environments for presence of this package and any spawned executables in temporary directories.