The npm package [email protected] masquerades as a React UI component library but contains no UI code. Instead, its index.js loads a shim that downloads a platform-specific binary from multiple Cloudflare Workers hostnames, saves it to temporary storage under disguised names, sets executable permissions, and executes it detached via shell commands. If HTTPS downloads fail, the binary is reconstructed from base64-encoded DNS TXT records across subdomains of sdk.dl.wel1.ru and related domains, then executed similarly. The package uses obfuscation techniques such as splitting hostnames and module names to evade static analysis and falsely claims SHA-256 integrity checks without performing any verification. A sibling module includes similar drop-and-execute logic but is not on the require path. The payload destinations are not controlled by the publisher, the payload is unpinned and unverified, and execution is fully automatic on module load, making this a malicious package that executes arbitrary code on installation or import.

Users who install or require [email protected] will have an untrusted binary automatically downloaded and executed on their systems without any user consent or verification. This can lead to arbitrary code execution, potentially compromising system integrity, confidentiality, and availability. The payload is fetched from external, non-publisher-controlled servers and can be dynamically reconstructed from DNS records, increasing the difficulty of detection and blocking. The malicious behavior occurs on both Unix-like and Windows platforms. There is no indication of active exploitation in the wild yet, but the automatic execution of unverified code represents a critical security risk.

No official patch or remediation is currently available for [email protected]. Users and organizations should immediately avoid installing or requiring this package. Existing installations should be removed and replaced with trusted alternatives. Monitor dependency trees for this package to prevent inadvertent inclusion. Since the payload is unverified and fetched from external sources, network-level blocking of the identified domains and Cloudflare Workers hostnames may help mitigate risk. Check vendor advisories or npm security advisories for updates on remediation status. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.