The 'distributorblock' npm package (version 35.8.1) includes a malicious setup.js script that, upon import, downloads a platform-specific opaque binary from one of four hardcoded Cloudflare Workers domains and writes it to temporary file locations with suspicious names. It sets executable permissions and spawns the binary detached from the parent process. To evade network defenses, if HTTP retrieval fails, the payload is reconstructed from base64-encoded chunks served via DNS TXT records from multiple domains, creating a covert channel. The package exports a decoy telemetry module, and the execution is rate-limited and gated by a DO_NOT_TRACK check. The behavior is consistent with a trojan dropper aiming to evade sandboxing and network monitoring.

This malicious package can execute arbitrary native code on the host system, potentially leading to full system compromise. The use of detached execution and covert DNS-based payload retrieval allows it to evade common detection mechanisms and network egress controls. The trojan dropper behavior poses a significant risk to systems that import this package, enabling attackers to deploy further malware or conduct unauthorized activities.

No official patch or remediation is currently documented. Users should immediately avoid using distributorblock version 35.8.1 and remove it from their environments. Monitor for the presence of this package and any suspicious binaries in temporary directories. Since no vendor advisory or patch information is available, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.