The hex-encode-utils npm package (versions 1.0.0 to 1.0.5) includes a postinstall script (scripts/compat.js) that downloads an AES-256-GCM encrypted payload from two hardcoded Cloudflare Workers domains with TLS verification disabled. It decrypts this payload using a hardcoded key derived from a decoy string, writes the plaintext to a Python script in the user's cache directory, and executes it in a detached Python process. Prior to payload execution, the script sends a POST request containing the installer's hostname, username, platform, Node version, and package version formatted as an HTML Telegram message to a Telegram bot. Execution is gated by sandbox evasion checks that abort in CI or container environments and require the presence of typical developer directories. The package's legitimate functionality (hex encoding/decoding) does not justify network I/O, encrypted payload fetching, or host reconnaissance, indicating malicious intent.

This malicious package can execute arbitrary Python code on the host system during installation, potentially leading to unauthorized code execution and data exfiltration. The beaconing to a Telegram bot with detailed host information reveals reconnaissance activity that could facilitate further targeted attacks. The sandbox evasion techniques reduce the likelihood of detection in automated environments, increasing risk to developer workstations.

No official patch or remediation is currently documented for this package. Users should immediately avoid installing hex-encode-utils versions 1.0.0 through 1.0.5. Remove any installations of these versions and audit affected systems for unauthorized Python processes and network communications to the specified Cloudflare Workers domains and Telegram bot. Consider blocking network access to the identified malicious hosts. Monitor for suspicious postinstall scripts in npm packages and prefer verified packages from trusted sources.