The pfa-errors package version 20.4.9 includes malicious functionality in its index.js file that unconditionally loads a runtime.js script. This script fetches an opaque binary payload from one of three hardcoded Cloudflare workers.dev URLs, writes it to a temporary file with a decoy name, sets executable permissions, and spawns it detached using system shell commands. When HTTPS is unavailable, the binary is reconstructed through a DNS-TXT covert channel from base64-encoded chunks. The code fragments sensitive API names and hostnames into arrays and reassembles them at runtime to evade static analysis. Additionally, a second dropper with identical behavior is embedded in lib/telemetry.js but is not reachable from the main index.js entry point.

This malicious code enables remote code execution on any system that installs and runs the affected pfa-errors package version 20.4.9. The attacker can execute arbitrary platform-specific binaries fetched from attacker-controlled endpoints, potentially leading to full system compromise. The use of covert DNS channels and obfuscation techniques complicates detection and analysis.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal of the malicious package is confirmed, avoid using pfa-errors version 20.4.9. Consider removing the package from your environment and replacing it with a trusted alternative. Monitor for updates from the package maintainers or npm security advisories regarding remediation.