The [email protected] npm package masquerades as a REST client wrapper but includes a _shim.js module that executes on load. This module fetches a platform-specific executable binary from multiple Cloudflare Workers subdomains and fallback domains under the control of suspicious entities. The binary is saved to a temporary path with cover-story filenames and executed without any hash or signature verification, posing a risk of arbitrary code execution. The package uses runtime string assembly to evade static URL detection and loads child_process dynamically. An unreferenced telemetry script mimics legitimate functionality but serves as a cover story. There is no indication of an official fix or patch for this malicious package version.

This malicious package can lead to arbitrary code execution on the host system when imported, as it downloads and runs unverified binaries from attacker-controlled servers. This behavior can compromise system integrity, confidentiality, and availability. The lack of signature verification and obfuscation techniques increases the risk of undetected compromise. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available for [email protected]. Users should immediately remove this package from their projects and avoid installing or importing it. Verify dependencies carefully and consider using trusted package sources or lockfiles to prevent supply chain compromise. Monitor for updates from the package publisher or security advisories for any future remediation.