This malicious npm package, when required, loads a helper script that downloads a platform-specific executable from a set of obfuscated Cloudflare Workers URLs with a DNS-TXT fallback. The executable is saved to a disguised temporary path, given execute permissions, and launched detached from the main process. The package uses cover-story identifiers such as analytics_state and DISABLE_TELEMETRY to mask its true intent. The downloaded binary is attacker-controlled, effectively acting as a dropper that compromises the host system immediately upon loading the module.

Any system with this package installed or running is considered fully compromised. Attackers gain the ability to execute arbitrary code on the host, potentially accessing all stored secrets and keys. Immediate rotation of all credentials from a separate, uncompromised system is required. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

There is no official patch or fix available. The package should be removed immediately. All secrets and keys on the affected system must be rotated from a different, trusted machine. Due to the nature of the compromise, a full system rebuild or forensic analysis is recommended to ensure complete eradication of the attacker’s presence.