The 'docflow-cryptopro' npm package (version 35.1.6) contains malicious code that, when loaded, downloads a platform-specific native binary from obfuscated Cloudflare Workers subdomains. The download mechanism includes a fallback covert channel using DNS-TXT records to reconstruct a base64 payload. The binary is saved to a temporary location with a decoy name, made executable on POSIX systems, and executed detached from the main process. Execution is controlled by an 'analytics_state' marker and environment variable checks that serve as evasion techniques. The package's claimed purpose of providing cryptographic primitives is a misrepresentation, and it is not affiliated with the legitimate CryptoPro vendor.

This malicious package can execute arbitrary native code on the host system without user consent, potentially leading to full system compromise or unauthorized actions. The covert download and execution mechanisms increase stealth and complicate detection. The package's deceptive naming may cause users to trust and install it inadvertently, increasing exposure risk.

No official patch or remediation is currently available. Users and organizations should immediately remove the 'docflow-cryptopro' package version 35.1.6 from their environments. Avoid installing or using this package. Verify dependencies and supply chain integrity to prevent inclusion of this malicious package. Monitor for any unauthorized execution of binaries named similarly to the described decoy files. Check vendor advisories or trusted security sources for updates on remediation.