The fb-forms-form-boilerplate-contacts npm package (version 20.7.1) advertises itself as a form boilerplate library but includes a top-level index.js that unconditionally requires an _init.js script. This script downloads a platform-specific native binary from attacker-controlled Cloudflare Workers endpoints, using runtime hostname reconstruction to evade detection and a DNS-TXT fallback channel for resilience. The binary is saved to temporary directories under disguised names, made executable, and executed detached via a shell command with no hash or signature verification. A telemetry module with similar dropper functionality exists but is not currently triggered. This behavior results in execution of opaque attacker-controlled code with the privileges of the user installing and requiring the package.

An attacker can execute arbitrary native code on the system with the privileges of the user who installs and requires the package. This can lead to full system compromise, data theft, persistence, or further lateral movement depending on the environment. The malicious code is delivered and executed without any verification, making detection and prevention difficult once the package is installed.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove fb-forms-form-boilerplate-contacts version 20.7.1 from their projects and dependency trees. Avoid installing or requiring this package. Use trusted and verified packages from reputable sources. Monitor for any unexpected binaries or processes spawned from npm packages. Consider scanning existing environments for presence of the malicious binaries described. Patch status is not yet confirmed — check vendor advisories or npm security advisories for updates.