The 'cardsmobile-storage' npm package version 35.6.5 includes malicious code that, upon requiring the package, loads a shim that selects a platform-specific payload URL from an obfuscated list of Cloudflare Workers subdomains. It also uses DNS-TXT record fallback for payload discovery. The downloaded binary is saved under disguised names in temporary directories, permissions are set to executable on POSIX, and the binary is spawned in a detached process using shell commands. The package dynamically assembles hostnames and module names at runtime to evade static scanners. Additionally, a parallel dropper with similar behavior is embedded in 'lib/telemetry.js', labeled as an 'Analytics SDK', providing an alternate execution path.

The malicious code enables remote code execution on the host system by downloading and executing arbitrary binaries without user consent. This can lead to full system compromise, data theft, or further malware deployment. The obfuscation and runtime assembly techniques make detection difficult, increasing the risk of unnoticed compromise.

Users should immediately remove and avoid using version 35.6.5 of the 'cardsmobile-storage' npm package. Since no patch or remediation is currently available, replacing this package with a trusted alternative or verifying the integrity of dependencies is recommended. Monitor for any unusual process executions related to this package and clean affected systems. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.