The npm package [email protected] includes a _runtime.js module that is automatically loaded and reconstructs obfuscated attacker-controlled hostnames to fetch binaries via HTTPS. These binaries are saved to temporary directories with decoy filenames, permissioned, and executed detached from the parent process. If HTTPS retrieval fails, the package uses a DNS TXT record covert channel to fetch base64-encoded payload chunks from specific domains, reassembles them, and executes the payload similarly. The package's claimed purpose as a UI library is a cover for this malicious behavior, which leads to full remote code execution on any system that imports the package.

Any consumer that requires or imports [email protected] triggers full remote code execution on their host. This allows attackers to execute arbitrary code with the privileges of the importing process, potentially leading to complete system compromise. The malicious payload is fetched dynamically from attacker-controlled infrastructure, making detection and prevention difficult. The obfuscation of hostnames and use of DNS covert channels further complicate detection.

No official patch or remediation is currently available for [email protected]. Users should immediately cease using this package and remove it from their projects. Avoid importing or requiring this package in any environment. Monitor dependency trees to ensure this package is not included transitively. Consider using trusted package sources and verifying package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.