The 'native-runner' npm package includes a top-level immediately-invoked function expression (IIFE) in its index.js that polls for up to two minutes for a binary file at %APPDATA%\Microsoft\Windows\node_runtime_helper.exe. Once detected, it launches this binary detached and hidden, allowing the process to run without user visibility or output capture. The package's only declared dependency, 'img-to-native@^1.0.0', is not used in code but is responsible for placing the malicious binary at the hardcoded path. Together, these packages form a drop-and-execute malware chain that compromises any system where 'native-runner' is installed or imported.

Any system with 'native-runner' installed or running is considered fully compromised. The attacker gains persistent, hidden execution capabilities via the dropped binary. All secrets and keys stored on the compromised machine should be considered exposed and must be rotated immediately from a secure environment. Simply removing the package does not guarantee removal of all malicious components or persistence mechanisms.

Remove the 'native-runner' package immediately. Rotate all secrets and keys stored on the affected machine from a different, trusted device. Conduct a thorough system investigation and remediation, as the malicious binary runs detached and hidden and may have established persistence or additional backdoors. There is no official patch or fix available; the package itself is malicious. Avoid installing or importing this package.