The [email protected] npm package masquerades as a fetch helper but includes a malicious dropper. When loaded, it unconditionally executes a platform-specific native binary fetched from one of four hardcoded Cloudflare Workers domains or reconstructed from DNS TXT records on *.dl.wel1.ru subdomains. The binary is saved to temporary locations with names resembling legitimate telemetry files and executed detached from the main process. Environment variables such as DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK gate this behavior to appear optional. This results in arbitrary remote code execution controlled by the operators of the infrastructure hosting the payloads.

This malicious package enables arbitrary remote code execution on any host that installs and requires [email protected], potentially allowing attackers full control over the affected system. The payload is delivered stealthily and executed with minimal user awareness, posing a severe risk to system integrity and confidentiality.

No official patch or remediation is currently documented. Users should immediately avoid installing or using [email protected]. Remove the package from any affected environments and audit systems for the presence of the dropped binaries in temporary directories. Monitor for suspicious processes spawned from temporary locations with names like 'dotnet_diag_*.exe'. Since no patch is available, the best mitigation is to avoid the compromised package and use trusted alternatives. Check vendor advisories or npm security advisories for updates.