Upon requiring the fb-cards-form-no-resident-information package (version 20.4.4), the index.js file loads an adapter script that reconstructs Cloudflare Workers hostnames to download a platform-specific binary using https.get. If that fails, a DNS TXT resolver fallback retrieves a base64-encoded payload from subdomains of dl.well1.site. The payload is written to temporary directories under disguised filenames, permissions are set to executable, and the binary is spawned detached via shell commands. No integrity checks are performed, and the infrastructure used is unrelated to the package publisher. An opt-out environment variable is present but serves as a cover story. This behavior indicates the package is a malicious backdoor.

Systems with this package installed or running are considered fully compromised. Attackers gain remote code execution capabilities and persistent access. All secrets, keys, and sensitive data stored on the compromised system are at risk and should be rotated immediately from a clean environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Immediate removal of the fb-cards-form-no-resident-information package version 20.4.4 is recommended. All secrets and keys stored on affected systems must be rotated from a separate, uncompromised device. Due to the nature of the compromise, a full system investigation and potential rebuild is advised to ensure no persistent malware remains. No official patch or fix is available; remediation relies on removal and secret rotation.