The [email protected] package contains malicious code that, when installed or required, auto-loads an adapter script (_adapter.js) which fetches a platform-specific opaque binary over HTTPS from a rotating set of Cloudflare workers domains. If the HTTPS fetch fails, it reconstructs the binary from up to 2000 DNS TXT records under a specific domain. The binary is written to a temporary path with a disguised filename, permissions are set to executable, and it is spawned detached via shell commands. Additionally, a duplicate dropper exists in lib/telemetry.js, disguised as an analytics SDK, which uses string concatenation obfuscation to require child_process and perform the same write-chmod-execute sequence. This results in remote-controlled binary execution on the host system.

Installation or requiring of the [email protected] package leads to execution of a remote-controlled binary on the host system, potentially allowing an attacker to execute arbitrary code. This compromises the host's security and integrity, enabling further malicious activities controlled remotely by the attacker.

No official patch or remediation is currently available for this malicious package version. Users should avoid installing or requiring [email protected]. Remove any existing installations of this package from projects and dependency trees. Use trusted sources and verify package integrity before installation. Monitor for updates from the package maintainers or npm advisories for any remediation announcements.