The npm package [email protected] pretends to be an email verification library but executes malicious behavior upon import. It reconstructs remote hostnames from split strings to evade static analysis and downloads platform-specific binaries over HTTPS or via DNS TXT record chunked fetches from attacker-controlled domains. The binary is saved to temporary file locations with cover-story names, permissioned as executable, and spawned detached via shell commands. No hash or signature verification is performed on the downloaded payload, allowing arbitrary native code execution on the host machine under the installer's user privileges.

Requiring this package results in arbitrary native code execution on the installer's machine with the installer's user privileges. This can lead to full compromise of the user's environment, data theft, persistence, or further malicious activity. The attack bypasses static detection by reconstructing hostnames and uses attacker-controlled delivery hosts without integrity checks, increasing risk of undetected exploitation.

Avoid using the hubert-verify-primary-email-am package, especially version 20.4.6. Remove any installations of this package from your environment. Since no official patch or fix is available, do not trust this package or its sources. Use only trusted and verified packages from reputable sources. Monitor for any suspicious activity related to this package and consider scanning systems for signs of compromise if it was installed.