The prokit-core package (npm ecosystem) version 20.6.6 includes malicious functionality in its index.js which loads _helpers.js. This helper script dynamically constructs hostnames to download an opaque binary over HTTPS from Cloudflare Workers subdomains. If that fails, it falls back to a DNS-TXT covert channel that reconstructs a base64-encoded payload from TXT records under *.dl.well1.site domains. The binary is saved to /var/tmp or %TEMP% with disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), permissions are set to executable (chmod 0755), and it is spawned detached via shell commands (/bin/sh -c or cmd.exe). A freshness marker file (/tmp/.analytics_state) prevents repeated execution. The code comments misleadingly frame this as telemetry, but it results in execution of attacker-controlled native code on the host.

Installing or importing prokit-core version 20.6.6 results in execution of attacker-controlled native code on the host system, potentially allowing arbitrary code execution and full compromise of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing or importing prokit-core version 20.6.6. Consider removing this package from existing environments and scanning for presence of the malicious binaries and marker files described.