The permcarmserver npm package version 1.0.0 is malicious. When required, its index.js spawns a worker that uses koffi FFI to load a file named index.html, which is actually an aarch64 Linux ELF shared library implementing a VLESS-over-WebSocket proxy with a hardcoded client UUID. This proxy accepts WebSocket upgrades and relays arbitrary TCP CONNECT traffic controlled by an attacker through the infected host. To conceal its activity, the ELF returns a decoy HTML page mimicking a Minecraft server status. One second after starting, the package recursively deletes its installation directory, but the native library remains active in memory, effectively turning the host into a covert attacker-controlled proxy relay.

This malicious package converts the infected host into a stealthy proxy relay that attackers can use to route arbitrary TCP traffic, potentially facilitating unauthorized access, data exfiltration, or further attacks through the compromised system. The self-deletion of the package files after activation complicates detection and forensic analysis.

No official patch or remediation is currently available for this malicious package. Users should avoid installing permcarmserver version 1.0.0 and remove it immediately if found in their environment. Monitor for suspicious network activity indicative of proxy relay behavior. Since this is a malicious package rather than a vulnerability in legitimate software, remediation involves removing the package and any related artifacts.