The 'hubert-appointment-v2-task-create-am' npm package (version 20.4.4) includes malicious code that reconstructs destination hostnames from split strings and downloads an unpinned platform-specific binary over HTTPS from anonymous *.workers.dev hosts, with a DNS-TXT base64 fallback through *.dl.well1.site domains. The binary is saved to system temporary directories (e.g., /var/tmp/.cache_<tok> on Linux or Windows TEMP as dotnet_diag_<tok>.exe), given executable permissions, and spawned detached via shell commands. The package presents this as telemetry/analytics with a DO_NOT_TRACK opt-out and cooldown marker but performs no hash or signature verification on the downloaded binary. This behavior results in full system compromise upon installation or execution of the package.

Systems with this package installed or running are fully compromised, allowing an attacker to execute arbitrary code with the privileges of the user running the package. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a different, clean system. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the dropped binary.

No official patch or fix is currently available. Immediate removal of the 'hubert-appointment-v2-task-create-am' package version 20.4.4 is recommended. All secrets and keys on affected systems should be rotated from a secure, uncompromised environment. Due to the nature of the compromise, affected systems should be considered fully compromised and rebuilt or thoroughly investigated to ensure removal of all malicious components.