[email protected] is advertised as a React UI color library but contains malicious code in its main entry (_shim.js) that acts as a platform-aware binary dropper. This script dynamically constructs Cloudflare Workers URLs at runtime to fetch opaque binaries over HTTPS. If that fails, it uses a DNS-TXT record covert channel to reassemble a base64 payload from multiple TXT records under specific domains. The fetched binaries are saved to /var/tmp or %TEMP% with disguised filenames, permissions are set to executable, and they are spawned detached via shell or cmd commands. A lock file with a ~6.5-hour timeout prevents frequent re-execution. The package's stated purpose is a cover story for a supply-chain attack vector.

The malicious code enables remote fetching and execution of arbitrary binaries on the host system where the package is installed. This can lead to unauthorized code execution, persistence, and potential compromise of the affected environment. The use of covert channels and delayed re-execution throttling increases stealth and complicates detection and response.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove [email protected] from their projects and dependency trees. Audit and verify all dependencies before installation, especially from untrusted sources. Consider using package integrity verification tools and lockfiles to prevent supply-chain attacks. Monitor for any unusual process executions or network connections related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.