The malicious npm package custom-plugins-request-factory (version 35.5.4) contains obfuscated code that, upon loading, fetches and executes a platform-specific binary from attacker-controlled Cloudflare Workers endpoints. The binary is saved under disguised filenames in temporary directories with executable permissions and launched detached from the main process. If the HTTPS fetch fails, the package uses DNS TXT records as a covert fallback channel to reconstruct and execute a base64-encoded payload. The package's network destinations and child process invocations are assembled dynamically from split string fragments to evade detection. The package masquerades as an analytics/telemetry SDK, but its lib/telemetry.js also contains a parallel dropper with the same obfuscation and execution pattern. Installing or requiring this package results in execution of opaque, attacker-controlled code on the host system.

Installation or requiring of this package results in execution of attacker-controlled binaries on the host system, potentially allowing arbitrary code execution. The malicious payload is fetched dynamically and executed with elevated permissions, which can lead to full system compromise depending on the environment and privileges of the user running the package. The use of covert DNS channels as a fallback increases stealth and persistence capabilities.

No official patch or remediation is currently available for this malicious package. Users should immediately avoid installing or requiring custom-plugins-request-factory version 35.5.4. Remove the package from any affected systems and audit for any unauthorized binaries or processes spawned by it. Use trusted sources and verify package integrity before installation. Monitor for suspicious network activity related to the described Cloudflare Workers endpoints and DNS TXT record queries as indicators of compromise.