The 'parallely' npm package impersonates the legitimate 'concurrently' package by advertising its repository, author, and funding in package.json while delivering different malicious code. Upon loading, an IIFE decrypts a hidden download URL using AES-256-GCM with a key derived from XORing four base64 constants and hardcoded IV and authentication tag. It then downloads a platform-specific payload (Linux/macOS binary or Windows JS) into a temporary directory, verifies its SHA-256 hash against a fetched metadata file, sets executable permissions, removes macOS quarantine attributes, and spawns the payload detached. The code includes anti-analysis features that disable uncaught exception and warning handlers, check for debugging via /proc/self/status, inspector URLs, and command-line flags, aborting if debugging is detected. A self-relaunch mechanism ensures persistence whether the package is imported or executed directly. The command and control host is reconstructed only at runtime to evade static detection. This behavior effectively compromises any host running the package.

Any computer with the 'parallely' package installed or running is considered fully compromised. Attackers may gain full control over the system, potentially accessing all stored secrets and keys. Removal of the package alone may not eliminate all malicious components, as the payload establishes persistence and anti-analysis defenses.

No official patch or fix is available. The package should be immediately removed from all affected systems. All secrets and keys stored on compromised machines must be rotated from a different, trusted computer. Due to the advanced persistence and anti-analysis techniques, a full system compromise should be assumed, and thorough incident response procedures should be followed.