The 'dippy-invertor' npm package (version 35.1.6) includes code in its index.js that unconditionally loads an external script (_ext.js), which downloads an OS-specific executable from four hardcoded Cloudflare Workers domains. If HTTPS download fails, it falls back to retrieving the payload via a DNS-TXT covert channel from multiple domains by querying TXT records in chunks, base64-decoding and concatenating them. The payload is saved to temporary directories with disguised filenames ('.cache_<hex>' on Unix, 'dotnet_diag_<hex>.exe' on Windows), permissions are set to executable, and the binary is spawned detached and unreferenced using shell commands. The code uses string splitting and concatenation to evade detection and employs misleading identifiers to disguise its behavior. There is no legitimate reason for the package to fetch and execute remote binaries at load time, indicating malicious intent.

This malicious behavior allows arbitrary code execution on the host system when the package is loaded, potentially leading to full system compromise depending on the payload. The covert DNS-TXT fallback channel indicates an attempt to evade network detection and maintain persistence. Because the payload is executed detached and unreferenced, it may evade process monitoring. There is no indication of known exploits in the wild yet.

No official patch or remediation is currently available for this package version. Users should immediately remove or avoid using 'dippy-invertor' version 35.1.6. Audit systems for any presence of this package and any suspicious binaries in temporary directories named '.cache_<hex>' or 'dotnet_diag_<hex>.exe'. Network monitoring for connections to the specified Cloudflare Workers domains and the fallback DNS-TXT domains may help detect attempts to fetch the payload. Consider blocking these domains and removing the package from dependency trees.