The 'elephant-array-utils' npm package version 1.0.6 includes a top-level immediately-invoked function expression (IIFE) with obfuscation techniques such as rotated string arrays, RC4 decoding, control-flow flattening, and hex literals. Instead of providing legitimate array utilities, it constructs a hardcoded IPv4 address and performs an HTTPS GET request to retrieve an encrypted payload. The payload is decrypted using createDecipheriv with a buffer-keyed cipher, saved to a file in the current working directory, and executed via child_process.exec with windowsHide set to true. This behavior constitutes a canonical remote-payload dropper, granting arbitrary code execution to the attacker controlling the hardcoded IP address. The obfuscation hides the exfiltration/dropper URL, decryption key, and execution command. The generic package name suggests it is intended as a typosquatting lure.

Any system that installs or requires 'elephant-array-utils' version 1.0.6 is at risk of arbitrary code execution controlled by the attacker hosting the payload. This can lead to full system compromise depending on the privileges of the executing process. The malicious code executes automatically upon requiring the package, making it a high-risk supply chain threat.

No official patch or remediation is provided in the available data. Users should immediately remove and avoid installing 'elephant-array-utils' version 1.0.6. Verify dependencies to ensure this package is not included transitively. Consider using trusted package sources and scanning dependencies for malicious content. Monitor for updates from the package repository or vendor for any official advisories or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.