The ded-pwa-c-boxy-di npm package (version 35.2.2) includes a malicious loader that triggers on import. This loader constructs obfuscated hostnames at runtime to evade static detection and downloads a binary payload from Cloudflare Workers-hosted endpoints and a DNS-TXT fallback channel. The binary is saved to a temporary location with disguised filenames, permissions are set to executable (0755), and it is executed detached via shell commands (/bin/sh -c or cmd). The lack of any lifecycle hook requirement means that simply requiring the package initiates this behavior. No integrity checks such as pinning, hash verification, or signature validation are performed on the downloaded payload, allowing potential arbitrary code execution on the host.

This malicious package enables remote code execution on any system that imports it, potentially allowing attackers to run arbitrary binaries without user consent or awareness. The obfuscation of download endpoints and lack of payload verification increase the risk of undetected compromise and persistent infection. The impact includes unauthorized system control, data theft, or further malware deployment.

No official patch or remediation is currently documented for this package. Users should immediately avoid using ded-pwa-c-boxy-di version 35.2.2 and remove it from their projects. Employ strict package vetting and use trusted sources only. Monitor for suspicious network activity related to the described endpoints. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.