The 'invest-module-cookie' npm package (version 20.8.2) includes code in its index.js that loads an adapter script selecting an OS-specific asset path. This adapter downloads a binary payload from one of three obfuscated *.workers.dev domains, using a DNS-TXT covert-channel fallback to reassemble base64-encoded chunks from *.dl.well1.site subdomains. The payload is saved to /var/tmp or %TEMP% with a disguised filename, permissions are set to executable (0755), and it is executed detached via shell commands (/bin/sh -c or cmd.exe). The runtime assembly of destination hostnames from split string fragments is designed to evade static host scanning. The malicious payload is unrelated to the package's advertised functionality, and the publisher identity does not correspond to the hosting domains.

This malicious package can execute arbitrary binary code on the host system, potentially leading to full system compromise, unauthorized access, or further malware deployment. The use of obfuscated domains and covert DNS-TXT channels complicates detection and blocking. Since the payload is executed with the permissions of the running process, it can perform any actions allowed by those permissions.

No official patch or remediation is currently documented for this package. Users should immediately stop using 'invest-module-cookie' version 20.8.2 and remove it from their environments. Avoid installing packages from untrusted or unknown publishers. Monitor for and block network communications to the identified obfuscated domains if possible. Check vendor advisories or trusted security sources for updates or official guidance.