The 'pfp-block-mobile-steps' npm package version 20.9.3 includes malicious functionality in its index.js that unconditionally loads a shim script. This shim selects a payload path based on the platform and architecture, then downloads an opaque binary executable from one of four hardcoded Cloudflare Workers endpoints. To evade static detection, the hostnames are assembled at runtime from string fragments. If HTTPS retrieval fails, the payload is alternatively fetched out-of-band via DNS TXT record lookups from *.dl.well1.site domains, reconstructing the payload from multiple TXT records. The binary is saved to a temporary file with stealth filenames (e.g., dotnet_diag_*.exe, .cache_*), permissions set to executable on Unix, and launched detached with silenced stderr. No integrity checks such as hash or signature verification are performed. Execution is controlled by a run-once flag and opt-out environment variables, consistent with anti-analysis techniques. This behavior is unrelated to any legitimate platform adapter functionality and indicates malicious intent.

This malicious package can lead to arbitrary code execution on systems that install and run version 20.9.3 of 'pfp-block-mobile-steps'. The downloaded payload is opaque and executed without verification, potentially allowing attackers to run any code with the privileges of the user running the package. The stealthy execution and anti-analysis features increase the risk of undetected compromise.

No official patch or remediation is currently documented. Users should immediately avoid using version 20.9.3 of 'pfp-block-mobile-steps' and remove it from their environments. Since no fix is confirmed, users must rely on manual removal and monitoring for suspicious activity related to this package. Check vendor or repository advisories for updates or official guidance.