The hachutis npm package ships with three undeclared prebuilt executables under the bin/ directory that are not exposed via package.json. The declared main JavaScript file is unrelated to these binaries. One of the binaries, a large Bun-compiled executable, contains embedded references to an anonymous Cloudflare Tunnel host (already-query-bacteria-agreed.trycloudflare.com). The README instructs users to execute these binaries to activate the package, which opens a network tunnel from the host to an attacker-controlled domain. This behavior indicates the package is malicious, using obfuscated native payloads to establish a covert communication channel without user awareness.

Users who install and run the hachutis package versions 1.0.0 or 1.0.6 and execute the provided binaries risk their systems being connected to an attacker-controlled tunnel. This can lead to unauthorized remote access, data exfiltration, or further compromise of the host system. The malicious executables are not declared in the package manifest, increasing the likelihood of unnoticed execution and exploitation.

No official patch or remediation is currently documented. Users should avoid installing or executing the hachutis package versions 1.0.0 and 1.0.6. Remove any installations of this package and investigate hosts for signs of the malicious binaries or active network tunnels to the specified Cloudflare Tunnel domain. Monitor for suspicious outbound connections to trycloudflare.com subdomains. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.