The pfp-forms-sme-registration-ooo npm package (version 20.2.1) includes malicious functionality in its index.js, which loads a polyfill script that dynamically reconstructs URLs to fetch a native binary from Cloudflare Workers and other suspicious domains. The binary is saved to hidden paths on POSIX and Windows systems, permissions are set to executable, and it is launched detached from the main process. No integrity checks (hash or signature) are performed on the downloaded binary. The package's advertised purpose does not require this native helper, and opt-out mechanisms rely on generic environment variables, making it ineffective. Installing or importing this package results in arbitrary code execution controlled by an attacker, effectively compromising the host.

Any system that installs or runs this package is at risk of full compromise due to arbitrary code execution from an unverified native binary. Attackers gain persistent, stealthy access and control over the host, potentially leading to theft of secrets, credentials, and further system compromise. Removal of the package alone does not guarantee eradication of the malicious payload or backdoors. Immediate secret and key rotation from a separate, uncompromised system is necessary.

Remove the pfp-forms-sme-registration-ooo package version 20.2.1 immediately. Consider the host fully compromised and perform a thorough incident response, including rotating all secrets and keys from a clean environment. There is no known patch or official fix available. Avoid installing or importing this package. Monitor for any suspicious activity related to this package's domains or execution patterns.