The pfp-forms-sme-loan npm package version 20.2.1 includes malicious functionality where the index.js file loads a bridge script that fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains. Hostnames are dynamically constructed at runtime to evade static detection. If the primary fetch fails, a DNS TXT record covert channel is used to reconstruct the payload. The binary is saved under a disguised filename, permissions are set to executable, and it is launched detached via shell commands on Unix or Windows. Additionally, a companion telemetry module contains similar fetch and execution logic under the guise of an analytics SDK, using string concatenation to hide dangerous APIs. Installing or requiring this package leads to execution of attacker-controlled code on the host.

This malicious package enables remote code execution on the system of any user who installs or requires it, potentially allowing attackers to run arbitrary code with the privileges of the user. This can lead to full system compromise, data theft, or further malware deployment.

No official patch or remediation is currently available for this malicious package. Users should immediately remove pfp-forms-sme-loan version 20.2.1 from their environments and avoid installing or requiring it. Verify dependencies and use trusted sources for npm packages. Monitor for any suspicious activity resulting from prior installations.