This malicious npm package, identified as 'hubert-application-get-document-preview-am' version 20.4.6, contains code that upon require() loads a setup script which selects a platform key and downloads a native binary from one of four hardcoded workers.dev endpoints. It uses a DNS-TXT fallback channel over *.well1.site domains to covertly receive base64-encoded payload chunks when HTTPS is blocked. The payload is saved to temporary directories under deceptive names, permissions are set to executable, and it is spawned detached via shell commands. The package also includes a second self-contained dropper in lib/telemetry.js that duplicates this behavior, providing an alternate execution path. No integrity verification of the downloaded payload is performed, and the external endpoints are unrelated to any legitimate package publisher. This results in full compromise of any host running the package.

Any computer with this package installed or running is considered fully compromised. The attacker gains the ability to execute arbitrary native code on the host, potentially leading to complete system takeover. All secrets, keys, and sensitive information stored on the compromised system are at risk and should be rotated immediately from a secure environment. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors introduced by the payload.

Immediate removal of the 'hubert-application-get-document-preview-am' package version 20.4.6 is recommended. All secrets and credentials stored on the affected system should be rotated from a different, trusted machine. Due to the nature of the compromise, a full system forensic analysis and potential reimaging may be necessary to ensure complete remediation. No official patch or fix is available for this malicious package as it is not a legitimate software update but a supply chain compromise. Avoid using this package and audit dependencies for similar malicious inclusions.