The npm package [email protected] is a malicious package that executes a binary dropper automatically when required. The main entry point index.js requires an initialization script that downloads platform-specific binaries from multiple obfuscated Cloudflare Workers domains with DNS TXT record base64 chunk fallbacks from several Russian-hosted domains. The downloaded payloads are saved to temporary directories with disguised filenames, permissions are set to executable, and the binaries are launched detached via shell commands. The package uses runtime string concatenation to reconstruct sensitive API calls to evade static detection. Additionally, a parallel dropper in lib/telemetry.js performs a similar write/chmod/execute routine under the guise of an analytics SDK. This behavior enables remote payload execution immediately upon importing the package, posing a severe supply chain risk.

This malicious package enables remote code execution on any system that installs and requires [email protected]. The automatic execution of downloaded binaries can lead to full system compromise, data theft, or further malware deployment. Because the payload is dropped and executed without user interaction, any dependent software or CI/CD pipeline using this package is at risk. The obfuscation and multiple fallback download methods increase the likelihood of successful payload delivery and evasion of detection.

No official patch or remediation is currently available for [email protected]. Users and organizations should immediately remove this package from their dependencies and replace it with a trusted alternative. Audit software supply chains for usage of this package and block network connections to the identified malicious domains. Monitor for any signs of compromise related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.