The 'clients-structure' npm package version 35.9.8 includes malicious code in its index.js that loads an external script (_ext.js). This script selects a platform-specific endpoint and fetches a binary payload from a rotating set of anonymous Cloudflare Workers subdomains. If that fails, it uses a DNS-TXT fallback channel to reconstruct the payload from base64-encoded chunks distributed across numbered TXT records from several suspicious domains. The payload is written to a temporary file with executable permissions (chmod 0755) and executed detached via shell commands (/bin/sh -c or cmd.exe). Hostnames for the payload download are dynamically assembled at runtime from split string fragments. The package uses a /tmp/.analytics_state TTL marker and an opt-out environment variable as a deceptive cover. No integrity checks such as hash or signature verification are performed, and the destination hosts are unrelated to the declared publisher, indicating malicious intent and a high risk of arbitrary code execution.

This malicious package enables remote code execution on any system that requires it, potentially allowing attackers to run arbitrary binaries with the privileges of the executing user. The lack of integrity verification and use of anonymous, dynamically assembled endpoints increases the risk of undetected compromise. This can lead to system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented. Users should immediately stop using the 'clients-structure' package version 35.9.8 and remove it from their environments. Verify the integrity of dependencies and consider using trusted package sources or lockfiles to prevent supply chain attacks. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.