The damir-cbr-dawdntrnssbf npm package version 35.8.1 includes a malicious _polyfill.js script that downloads a platform-specific binary from attacker-controlled Cloudflare Workers hosts, using a DNS TXT record chunked-base64 fallback channel when HTTPS egress is blocked. The binary is saved to a hidden temporary path, permissions are set to executable, and it is spawned detached via shell commands. The command-and-control hostnames are dynamically reconstructed from split string fragments to evade static detection. The fetched binary is opaque, unversioned, and not verified by hash, originating from infrastructure unrelated to the package publisher. This behavior is falsely presented as telemetry or analytics.

This malicious package can lead to remote code execution on the host system by downloading and running arbitrary binaries controlled by attackers. The covert DNS fallback channel allows communication even when HTTPS is blocked, increasing stealth and persistence. The execution of unverified binaries from attacker infrastructure poses a high risk of system compromise, data theft, or further malware deployment.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove version 35.8.1 of damir-cbr-dawdntrnssbf from their environments and avoid installing or using this package. Employ supply chain security measures such as verifying package integrity and sourcing from trusted maintainers. Monitor for any unexpected processes spawned from temporary directories as described. Check vendor advisories or trusted security sources for updates on remediation.