The [email protected] npm package acts as a dropper that, upon require(), loads a helper script which constructs Cloudflare Workers hostnames from fragmented strings at runtime. It then downloads platform-specific binaries via HTTPS, writes them to temporary directories, sets executable permissions, and executes them detached using shell commands. A secondary dropper mechanism in telemetry.js repeats this behavior under the guise of an analytics SDK. The package uses runtime concatenation of sensitive identifiers like 'child_process' and 'chmodSync' to avoid static analysis detection. There is no legitimate native build functionality; the package's sole purpose is to fetch and execute attacker-controlled binaries on the host system.

This malicious package can execute arbitrary attacker-controlled binaries on the host system with the privileges of the user running the Node.js process. This can lead to full system compromise, data theft, persistence, and lateral movement depending on the payload delivered. The dynamic and obfuscated nature of the payload fetching and execution makes detection and prevention challenging.

There is no official patch or remediation available for this malicious package. The recommended mitigation is to immediately remove [email protected] from all projects and dependency trees. Avoid installing or using this package. Use trusted sources and verify package integrity before installation. Monitor for any signs of compromise on systems where this package was installed and perform incident response as needed.