The 'cnb-cnb-core' npm package version 35.2.7 includes a malicious module (_shim.js) that, upon requiring the package, downloads a platform-specific executable from obfuscated and dynamically constructed remote hosts. It writes the executable to temporary directories under decoy filenames, sets executable permissions, and spawns it detached from the main process. If the HTTP fetch fails, it uses a DNS-TXT record covert channel to retrieve base64-encoded payload chunks, reassembles them, and executes them similarly. The package attempts to evade detection by using environment variable checks and decoy telemetry controls, but ultimately executes attacker-supplied code without any hash or signature verification, posing a significant risk.

This malicious package enables remote code execution on the host system by downloading and running attacker-controlled executables without integrity checks. The obfuscation and fallback mechanisms increase the difficulty of detection and prevention. This can lead to full system compromise, data theft, or further malware deployment depending on the attacker's payload.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.2.7 of 'cnb-cnb-core' from their environments and avoid using this package. Employing supply chain security measures such as verifying package provenance and using trusted package sources is recommended. Monitor for any unusual process executions or network connections related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.