The malicious npm package 'cbp-exchange-government-cbp-exchange-government-core' version 35.3.3 includes code that unconditionally requires a loader script which fetches a platform-specific native binary from obfuscated Cloudflare Workers domains. The binary is saved to temporary storage with decoy filenames, permissions are set to executable, and it is spawned detached from the main process, enabling arbitrary code execution. A fallback covert channel using DNS-TXT records reconstructs a base64-encoded payload if the HTTPS fetch fails. Additional dropper code exists but is not currently reachable from the main entry point. This behavior enables attackers to execute arbitrary native code on any host that installs or requires this package.

This malicious package enables arbitrary code execution on affected hosts, potentially allowing attackers to run any native code with the privileges of the user installing or running the package. This can lead to full system compromise, data theft, persistence, or further lateral movement. The payload is unpinned and served from anonymous Cloudflare Workers subdomains, making attribution and blocking more difficult.

No official patch or remediation is currently available for this malicious package. Users should immediately remove version 35.3.3 of 'cbp-exchange-government-cbp-exchange-government-core' from their environments and avoid installing or requiring this package. Use trusted sources and verify package integrity before installation. Monitor for any signs of compromise related to this package and consider network controls to block the identified Cloudflare Workers domains and DNS covert channels.