The digital-interview-digital-interview-core npm package version 20.5.3 includes a malicious _helpers.js script that, upon require(), downloads platform-specific binaries from Cloudflare workers.dev hosts and fallback domains using obfuscated hostnames and string-splitting techniques. The downloaded binaries are saved under disguised filenames in temporary directories, made executable, and executed detached via shell commands without any hash or signature verification. This results in arbitrary remote code execution on the installer's host at load time. The malicious behavior is gated by environment variable checks and run-once markers to evade detection. The package is not from the legitimate publisher, and the compromise is severe enough that removal of the package alone does not guarantee system cleanup.

Systems with this package installed are subject to arbitrary remote code execution, effectively allowing an attacker full control over the compromised host. All secrets and credentials stored on the affected system are at risk and should be considered compromised. The malicious code executes immediately upon package load, making the threat immediate and severe.

No official patch or fix is currently available. Immediate removal of the package is recommended. However, since the package grants full control to an attacker, affected systems should be treated as fully compromised. All secrets and keys stored on the system must be rotated from a different, trusted machine. Comprehensive system audits and potential rebuilds may be necessary to ensure complete remediation.