The npm package peter-desktop-peter-big-column (version 20.3.2) includes malicious code that, upon require(), loads a runtime script assembling download hostnames from split string fragments to hide destinations. It fetches a platform-specific binary via HTTPS with a DNS TXT fallback, writes it to temporary directories under disguised names, sets executable permissions on POSIX systems, and spawns the binary detached using shell commands. A second copy of this dropper is embedded under an SDK guise. The delivered binary is attacker-controlled and opaque, enabling full compromise of the host system. The obfuscation techniques hinder static detection. Removal of the package does not guarantee full remediation due to potential persistence of malicious payloads.

Any system with this package installed or running is considered fully compromised, potentially allowing attackers full control over the host. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a separate, trusted environment. The malicious binary executed by the package can persist beyond package removal, making eradication difficult.

Immediate removal of the peter-desktop-peter-big-column package version 20.3.2 is recommended. However, due to the potential full compromise of the system, all secrets and keys stored on the affected machine should be rotated from a clean environment. There is no known patch or official fix available. Consider rebuilding or restoring the system from a trusted backup to ensure complete remediation.