The fb-forms-form-boilerplate-contacts npm package (version 20.7.1) masquerades as a form boilerplate library but includes malicious code in its top-level index.js that unconditionally requires an initialization script. This script downloads a platform-specific native executable from attacker-controlled Cloudflare Workers endpoints, using runtime hostname reconstruction and DNS-TXT fallback channels to evade static analysis. The executable is saved to temporary directories under disguised filenames, permissions are set to executable, and it is launched detached via a shell command without any hash or signature verification. A sibling telemetry.js file contains similar dropper functionality prepared for future use. Upon npm install and require, the attacker-controlled native executable runs with the installer's privileges, leading to full system compromise.

Systems that install and run this package are fully compromised, as the package downloads and executes attacker-controlled native code with the installer's privileges. This can lead to complete control over the affected system, including potential theft or manipulation of secrets and keys stored on the machine. Removal of the package alone does not guarantee elimination of all malicious artifacts or persistence mechanisms.

Immediate removal of the fb-forms-form-boilerplate-contacts package version 20.7.1 is required. All secrets and keys stored on the affected system should be rotated from a different, trusted machine. Due to the nature of the compromise, a full system forensic analysis and potential rebuild is recommended to ensure no residual malicious code remains. There is no known patch or fixed version available; users must avoid using this package version entirely.