[email protected] is a malicious npm package that acts as a dropper. Upon requiring the package, its index.js loads _adapter.js, which selects a platform-specific payload and downloads it from one of four obfuscated Cloudflare Worker mirrors or a DNS-TXT chunked base64 covert channel fallback. The downloaded payload is saved to temporary directories (/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows) with names impersonating benign runtime artifacts, given executable permissions, and executed detached from the main process. The package uses a stamp file to gate re-execution and respects environment variables to disable telemetry, aiding sandbox evasion. No hash or signature verification is performed on the downloaded payload, allowing attacker-controlled code execution. The package falsely advertises a native mobile payment bridge but contains no such functionality.

Installing or requiring [email protected] results in arbitrary code execution on the host system via downloaded attacker-controlled payloads. This can lead to full system compromise depending on the payload. The malicious package does not provide legitimate functionality and is designed solely to drop and execute malicious code stealthily, evading sandbox detection and disabling telemetry.

No official patch or remediation is currently available for [email protected]. Users should immediately remove this package from their projects and avoid installing or requiring it. Verify dependencies carefully and use trusted sources. Employ supply chain security measures such as package integrity verification and monitoring for malicious packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.