The digital-interview-digital-interview-core npm package version 20.5.3 includes a _helpers.js script that, upon require(), downloads a platform-specific binary from Cloudflare workers.dev hosts whose names are dynamically reconstructed at runtime. If the download fails, it falls back to DNS TXT records from additional domains. The binary is saved to temporary directories with disguised filenames (.cache_<rand>, .analytics_state, dotnet_diag_<rand>.exe) and permissions set to executable. It is then spawned detached via shell commands without any hash or signature verification. This behavior enables arbitrary remote code execution on the installer's host at load time. The malicious code uses environment variable checks and obfuscated hostnames and filenames to evade static analysis and detection.

This vulnerability allows an attacker to execute arbitrary code remotely on the system where the package is installed, potentially leading to full system compromise. Because the malicious binary is downloaded and executed automatically during package load, any user or system installing or requiring this package version is at risk. No integrity checks on the downloaded binary increase the risk of tampering or further compromise.

No official patch or fix is currently available for this malicious package version. Users should immediately avoid installing or using digital-interview-digital-interview-core version 20.5.3. Remove any existing installations of this package and audit affected systems for signs of compromise. Consider using trusted package sources and verifying package integrity before installation. Monitor vendor advisories for updates or remediation guidance.