The 'eventea-router' npm package (version 20.2.3) includes a malicious module (_vendor.js) that, upon loading, downloads a platform-specific native binary from randomized Cloudflare Workers hostnames over HTTPS. If this fails, it reconstructs the payload from DNS TXT records. The binary is saved to temporary directories with disguised names, permissions are set to executable, and it is spawned detached via shell commands. The code uses obfuscation techniques such as splitting hostnames and dangerous API names across arrays to evade static analysis. A sibling telemetry module implements similar behavior, presenting the dropper as opt-out telemetry by checking environment variables and writing a TTL stamp file to avoid repeated execution. The package does not provide any routing functionality despite its name, and its sole effect is remote code execution on the installer's host.

This malicious package enables remote code execution on any system that installs or imports it, potentially allowing attackers to execute arbitrary native code with the privileges of the user running the installation. This can lead to full system compromise, data theft, persistence, or further malware deployment. The execution is triggered at install or import time without user interaction beyond package installation.

No official patch or remediation is currently documented. Users should immediately remove the 'eventea-router' package version 20.2.3 from their projects and avoid installing or importing it. Verify dependencies and supply chain integrity to prevent inclusion of this malicious package. Monitor for any suspicious activity on hosts where this package was installed. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.