The pfp-forms-sme-sitebuilder npm package version 20.2.1 includes malicious code in its index.js and a sibling telemetry.js module. On module load, index.js requires a support module that reconstructs attacker-controlled hostnames by splitting and joining string arrays to evade detection. It downloads a platform-specific binary via HTTPS from unverified, non-publisher-controlled hosts, writes it to a hidden staging path with masqueraded filenames, changes file permissions to executable (chmod 0755), and spawns the binary detached using system shell commands (/bin/sh -c on Unix or cmd.exe on Windows). The telemetry.js module contains similar dropper code but is not invoked in this version. This results in arbitrary code execution on any system that requires this package. The fetch destinations are unpinned and unverified, increasing risk. No patch or fix information is available.

This malicious package enables remote code execution on any system that installs and requires pfp-forms-sme-sitebuilder version 20.2.1. The attacker can execute arbitrary binaries with the privileges of the user running the package, potentially leading to full system compromise, data theft, or further malware deployment. The obfuscation and dynamic reconstruction of API calls and hostnames indicate deliberate concealment to evade detection.

No official patch or remediation has been provided for this malicious package version. Users should immediately remove pfp-forms-sme-sitebuilder version 20.2.1 from their projects and dependency trees. Avoid installing or requiring this package version. Verify package integrity and source before installation. Monitor for any unexpected network connections or spawned processes related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.