The npm package [email protected] side-effect-loads two internal scripts (_adapter.js and lib/telemetry.js) that assemble Cloudflare Workers hostnames and use a DNS-TXT fallback to fetch an opaque binary payload specific to the platform. This binary is saved to temporary directories with executable permissions and spawned detached via shell commands. The child_process module is required dynamically to evade static detection. The payload deploys at require() time, enabling remote code execution on the installer system. There is no version pinning or signature verification of the fetched executable, and the dropper code is duplicated to ensure execution even if one script is removed. The naming conventions used (telemetry, analytics_state, dotnet_diag_) are deceptive cover stories.

This malicious package enables remote code execution on any system that requires [email protected], potentially allowing attackers to execute arbitrary code with the privileges of the user running the npm install or require process. The lack of verification on the downloaded payload increases the risk of compromise. This can lead to full system compromise, data theft, or further malware deployment.

No official patch or remediation is currently available for this malicious package. Users should immediately remove and avoid using [email protected]. Verify dependencies carefully before installation and consider using package integrity verification tools. Monitor for any unexpected network activity or spawned processes related to this package. Check vendor or repository advisories for updates or removal notices.