The docsmate-docsmate-core npm package (version 35.9.3) includes code that dynamically constructs Cloudflare Workers hostnames and fallback DNS-TXT resolver domains to download an OS/arch-specific binary over HTTPS. This binary is saved to temporary directories with names designed to impersonate legitimate Microsoft.NET diagnostic tools and is executed detached from the main process using shell commands. The package does not contain native source code justifying this behavior, and destination hosts are string-obfuscated to evade static analysis. Environment variables can disable execution, and a stamp file prevents repeated runs.

This malicious behavior allows the package to execute arbitrary native code on the host system without user consent, potentially leading to unauthorized system access, persistence, or further compromise. The disguised binary and obfuscated network destinations complicate detection and analysis. There are no known exploits in the wild reported yet.

No official patch or remediation is currently available. Users should avoid using version 35.9.3 of docsmate-docsmate-core and remove it from their environments if present. Monitor for suspicious processes or files matching the described patterns. Check vendor advisories or npm security advisories for updates or official guidance.