The malicious npm package [email protected] includes a bootstrap script that dynamically reconstructs obfuscated domain names to download a native executable from attacker-controlled infrastructure. The executable is stored in temporary directories with hidden or misleading names, given executable permissions, and executed detached via shell commands. There is no integrity verification of the downloaded binary. This results in arbitrary code execution on the host system when the package is required, representing a supply chain compromise and remote code execution risk.

Any system that installs or requires [email protected] will execute an attacker-controlled native binary, potentially leading to full host compromise. The malicious code runs with the privileges of the user installing or running the package. This can lead to data theft, persistence, lateral movement, or other malicious activities. The lack of integrity checks and obfuscation techniques indicate deliberate evasion of detection.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring [email protected]. Remove the package from existing environments and audit for any signs of compromise. Monitor for updates from the package maintainer or npm security advisories for any official fixes or guidance. Until then, do not use this package version.