The 'filewisee' npm package masquerades as a date-formatting library but includes a malicious function 'formatd' that downloads and executes an opaque binary from an anonymous file host (pixeldrain.com) without any integrity verification. The binary is stored in a hidden directory (~/.drc/dr) with executable permissions and launched with hidden process settings, increasing the risk of unnoticed malicious activity. The package versions 0.1.0 and 0.1.1 are affected. There is no CVSS score or known exploits in the wild reported.

The malicious code can lead to arbitrary code execution on the user's system by downloading and running an unverified binary from an untrusted source. This can compromise system integrity, confidentiality, and availability depending on the payload of the downloaded binary. The hidden execution and storage increase stealth, making detection and response more difficult.

No official patch or remediation is currently available. Users should avoid installing or using the 'filewisee' package versions 0.1.0 and 0.1.1. If already installed, remove the package and delete the hidden directory '~/.drc' to eliminate the downloaded binary. Monitor for any suspicious activity related to this package. Check for vendor advisories or updates for any future fixes.