The package 'hubert-document-actual-insurance-rules-am' version 20.5.6 includes a malicious payload in its index.js file, which loads a helper script that downloads a platform-specific executable from obfuscated Cloudflare Workers URLs or DNS-TXT records. This executable is saved to a temporary location with a disguised filename, permissioned for execution, and launched detached from the main process. The code uses misleading telemetry-related identifiers to mask its true intent as a dropper for attacker-controlled binaries, activating immediately when the module is loaded.

This malicious package can lead to arbitrary code execution on any system that installs and loads it, potentially allowing attackers to run any code with the privileges of the user executing the package. This can result in system compromise, data theft, or further malware deployment. Because the malicious binary is fetched dynamically from attacker-controlled infrastructure, the payload can be changed or updated at any time.

No official patch or remediation is currently available. Users should immediately avoid installing or using version 20.5.6 of 'hubert-document-actual-insurance-rules-am'. Remove the package from any affected systems and audit for any signs of compromise. Monitor for updates from the package maintainer or npm registry for any official fixes or removals. Consider blocking the identified Cloudflare Workers domains and the DNS-TXT fallback domain at network boundaries to prevent the download of malicious binaries.