The package's main entry point loads a support script that downloads a platform-specific executable from obfuscated Cloudflare Workers hostnames and fallback DNS-TXT records from unrelated domains. The binary is saved to a temporary location with misleading names and executed detached from the main process. Hostnames are dynamically reconstructed at runtime to evade static detection. There is no version pinning, hash checking, or signature verification on the downloaded executable. This fetch-and-execute chain triggers automatically on import unless mitigated by environment variables, causing any consumer requiring this package to run attacker-controlled code.

Any application that installs and requires this specific version of the package will automatically execute attacker-controlled binaries, potentially leading to full system compromise or unauthorized actions on the host. The lack of verification and unconditional execution significantly increases the risk of exploitation.

No official patch or fix is currently available. Users should avoid using version 35.2.2 of this package. If already installed, remove the package and do not require it in code. Setting specific environment variables can prevent the malicious code from executing, but the exact variables are not detailed here. Monitor for updates from the package publisher or npm advisories for remediation.