[email protected] is a malicious npm package that acts as a dropper. Its index.js unconditionally requires a module that downloads a platform-specific binary from obfuscated Cloudflare Workers hostnames and fallback domains. The binary is saved to temporary directories under disguised filenames, permissioned as executable, and then executed detached via shell commands. The package attempts to masquerade as telemetry software by referencing environment variables related to telemetry opt-out, but this is a cover story inconsistent with its drop-and-execute behavior. Additionally, a second copy of the drop-and-exec logic is included in the package but not reachable in this version's import graph. Any import or require of this package results in execution of attacker-controlled native code on the host system.

Any system that installs or requires [email protected] will execute attacker-controlled native code, potentially leading to full compromise of the host. The malicious code downloads and runs binaries without user consent, bypassing normal security controls. This can result in arbitrary code execution, persistence, data theft, or further malware deployment. The telemetry cover story may mislead defenders or users about the package's true intent.

No official patch or remediation is currently documented for this malicious package version. The package should be considered malicious and removed immediately from any environment. Users and organizations should audit their dependency trees to detect and eliminate this package. Avoid requiring or importing [email protected]. Monitor for any binaries dropped to temporary directories with suspicious names as described. Since this is a malicious package rather than a vulnerability in legitimate software, remediation involves removal and blocking of the package rather than patching.