The [email protected] is a malicious npm package designed as a typosquat of the legitimate @nx/eslint-plugin. Upon being required, its index.js loads a runtime script that asynchronously downloads a platform-specific binary from one of three obfuscated Cloudflare Workers domains, with fallback to DNS-TXT chunked-base64 encoded payloads from several Russian-hosted domains. The binary is saved to temporary directories with disguised filenames (dotnet_diag_<suffix>.exe on Windows, .cache_<suffix> on Unix), permissions are set to executable on non-Windows systems, and the binary is executed detached via shell commands. The package assembles command and control hostnames and API names dynamically from string fragments to evade static analysis. It also implements a telemetry cover story with opt-out environment variables and cooldown stamps to reduce detection. Additionally, a second, currently unreferenced bundle (lib/telemetry.js) containing similar dropper functionality is shipped with the package.

This malicious package can execute arbitrary code on the host system by downloading and running a platform-specific binary without user consent. This can lead to unauthorized system compromise, data theft, or further malware deployment. The obfuscation and telemetry features increase the difficulty of detection and analysis.

No official patch or remediation is available as this is a malicious package rather than a vulnerability in legitimate software. The recommended mitigation is to avoid installing or requiring [email protected]. Users should verify package names carefully to avoid typosquatting attacks and use trusted sources. Security teams should scan for and remove this package if found in their environments.