The [email protected] package contains malicious code that acts as a dropper. Its index.js loads a vendor script that constructs a list of Cloudflare workers.dev endpoints and uses DNS-TXT fallback to resolve base64-encoded download data from multiple suspicious domains. It downloads a platform-specific binary, writes it to hidden filesystem locations with executable permissions, and spawns it detached via shell commands. The endpoints and filenames are obfuscated and gated behind flags named analytics_state and DISABLE_TELEMETRY. The dropped binary masquerades as .NET diagnostics tooling. There is no hash or signature verification of the downloaded binary, and the delivery mechanism does not verify the publisher or host. The malicious behavior is unrelated to the package's advertised UI input search functionality.

This package can silently download and execute an unknown binary on the host system, potentially leading to arbitrary code execution. The lack of verification or signature checks means the binary could be replaced or tampered with by attackers. The dropped binary's purpose is opaque, posing a risk of unknown malicious activity on affected systems.

No official patch or remediation is currently available for this malicious package. The best mitigation is to avoid using [email protected] and remove it from any projects or environments. Use trusted and verified packages from official sources. Monitor for any suspicious activity related to this package and consider scanning for the presence of the dropped binaries in the specified hidden paths.