The malicious code in [email protected] auto-loads a support script that reconstructs download host URLs at runtime from fragmented strings. It fetches platform-specific executable binaries over HTTPS and, if that fails, uses a covert DNS-TXT record channel to retrieve base64-encoded payloads. These payloads are written to temporary directories with disguised filenames, permissions are set to executable (0755), and the binaries are spawned detached using system shell commands. This technique bypasses static analysis and network egress filtering by splitting host literals and using DNS as a fallback transport.

This malicious behavior allows remote code execution on the host system by downloading and running arbitrary binaries without user consent. The covert DNS-TXT fallback channel enables payload delivery even in environments with strict HTTP egress filtering, increasing the risk of undetected compromise. The execution of disguised binaries in temporary directories can lead to persistence and further malicious activity on affected systems.

No official patch or remediation guidance is provided in the available data. Users should avoid using version 20.1.5 of evo-web-base-analytics-data. Investigate and remove this package from affected environments. Monitor for suspicious processes spawned from temporary directories with disguised names. Check vendor advisories or trusted security sources for updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.