The [email protected] npm package is a lure package embedding malicious code in its index.js and lib/telemetry.js files. On load, it requires a bootstrap script that downloads a platform-specific binary from hardcoded Cloudflare Workers domains with a DNS-over-TXT fallback to an unrelated Russian domain. The binary is saved to a disguised temporary location, permissions are set to executable, and it is spawned detached via shell commands. The code employs runtime string concatenation to obfuscate hostnames and function calls such as 'child_process' and 'chmodSync' to evade static scanners. The telemetry.js dropper is structurally identical but not reachable in this version. No hash or signature verification is performed on the downloaded binaries, and the external hosts are unrelated to the package's documented purpose, indicating malicious intent.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The obfuscation and lack of integrity checks increase the risk of undetected malicious payload execution. The presence of detached execution means the malicious process can persist independently of the npm package lifecycle.

Users should immediately remove [email protected] from their environments and avoid installing this package. Since no official patch or remediation is indicated, the best mitigation is to not use this package and audit dependencies for similar malicious packages. Employing supply chain security measures such as verifying package provenance and using trusted registries is recommended. Monitor for any unexpected binaries or processes spawned from npm packages.