The npm package [email protected] executes a dropper upon module load. Its main entry point requires a shim that selects a platform-specific asset path and downloads an opaque native binary over HTTPS from multiple hardcoded worker.dev hosts, with a DNS TXT-record fallback mechanism that reconstructs base64 chunks from several dl.wel1.ru domains. The destination hostnames and the child_process require call are dynamically constructed at runtime to evade static detection. The downloaded binary is saved to temporary directories with disguised filenames, permissions are set to executable, and it is spawned detached using shell commands. Additionally, a parallel dropper is bundled as lib/telemetry.js under an analytics SDK guise but is not currently invoked from entry points.

The malicious dropper enables execution of arbitrary native code on the affected system, potentially leading to unauthorized code execution, persistence, and further compromise. The dynamic URL construction and fallback mechanisms complicate detection and blocking. The presence of disguised filenames and detached execution further aid stealth. Although no known exploits in the wild are reported, the package poses a significant risk if used.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove [email protected] from their environments and avoid installing it. Employ package integrity verification and source validation to prevent installation of malicious packages. Monitor for and block network connections to the indicated malicious domains if possible. Check vendor advisories or trusted security sources for updates on remediation.