The malicious behavior in [email protected] is triggered during module load. The _adapter.js script fetches an opaque binary payload over HTTPS from one of four hardcoded Cloudflare workers.dev domains or a DNS TXT fallback under wel1.ru. The payload is saved to a disguised temporary file (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), permissions are set to executable, and it is executed detached via shell commands. Host strings are obfuscated by joining split fragments to evade static detection. The binary execution is limited by a local 'analytics_state' stamp file. No cryptographic signature or pinning is used to verify the payload, and the external hosts are not affiliated with the package registry or publisher infrastructure, indicating a supply chain compromise or malicious package insertion.

This malicious code enables remote code execution on the host system where the package is installed, by downloading and running an arbitrary binary from attacker-controlled infrastructure. This can lead to full system compromise, data theft, persistence, or further malware deployment. The lack of payload verification and use of external hosts increases the risk of undetected exploitation. The disguised filenames and throttling mechanism suggest attempts to evade detection and maintain stealth.

No official patch or remediation is currently documented for [email protected]. Users should immediately remove this package version from their projects and replace it with a trusted alternative or a version verified to be clean once available. Avoid installing or requiring this package until vendor or registry advisories confirm remediation. Monitor for any unusual execution of binaries named similarly to system diagnostics and network connections to the specified Cloudflare workers.dev domains and wel1.ru. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.