This malicious npm package version 35.9.2 includes code in its top-level index.js that unconditionally requires a platform-specific module. This module reconstructs obfuscated hostnames and uses DNS TXT record fallback to discover endpoints controlled by the attacker. It fetches a binary payload over HTTPS, writes it to temporary directories with executable permissions, and executes it detached via shell commands. The package uses string concatenation and splitting to evade static analysis, and the child_process module is dynamically required. The payload execution occurs immediately upon requiring the package, with minimal opt-out mechanisms. The fetched payload is unrelated to the package's declared functionality, indicating malicious intent.

The malicious code enables remote code execution on systems that install and run this package version, potentially allowing attackers to execute arbitrary binaries under the context of the user running the package. This can lead to system compromise, data theft, or further malware deployment. The obfuscation and immediate execution increase the risk of unnoticed compromise.

No official patch or remediation is currently documented. Users should avoid installing or using version 35.9.2 of this package. If already installed, remove the package immediately and scan affected systems for unauthorized binaries or processes spawned from this package. Monitor for suspicious activity related to the described domains and binaries. Check vendor or repository advisories for updates or official guidance.