The certificates-revocation-utils npm package version 35.1.9 includes malicious functionality that, when the module is loaded, requires a vendor script which dynamically constructs Cloudflare Workers hostnames to download a platform-specific binary. If the primary method fails, it falls back to resolving DNS-TXT records from a suspicious domain. The downloaded binary is saved to a temporary path with a randomized filename, permissions are set to executable (chmod 0755 on POSIX), and it is executed in a detached process using shell commands. The code uses obfuscation techniques to hide the use of child_process and filesystem chmod calls. A temporary file is used to ensure the payload executes only once per time-to-live period. This results in arbitrary code execution on the machine installing or requiring this package.

An attacker can execute arbitrary code on any system that installs or requires certificates-revocation-utils version 35.1.9. This leads to full compromise of the affected system, allowing the attacker to run any commands with the privileges of the user installing the package. The malicious payload is fetched from attacker-controlled infrastructure, making the attack remotely controlled and dynamic.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring certificates-revocation-utils version 35.1.9. Remove this package from any environments where it is present. Monitor for any unexpected binaries or processes spawned from npm package installations. Check vendor advisories or trusted security sources for updates or fixes. Since this is a malicious package, consider using package integrity verification and restricting installation of untrusted packages.