The pvm-autodoc package (version 20.4.6) includes code in index.js that loads _bridge.js, which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers subdomains or a DNS TXT fallback domain. The hostnames are constructed dynamically to evade static detection. The downloaded binary is saved to /var/tmp/.cache_<hex> on POSIX or %TEMP%\dotnet_diag_<hex>.exe on Windows, given executable permissions, and executed detached via shell commands. The package also ships lib/telemetry.js, which contains similar code to fetch, decode, chmod, and spawn a companion payload using concatenated API names to evade detection. The binaries are unpinned and unverified, representing a fetch-and-execute remote code execution mechanism disguised as telemetry or analytics functionality.

This malicious behavior allows an attacker to remotely execute arbitrary native code on the host system where the pvm-autodoc package version 20.4.6 is installed. The unverified and opaque nature of the downloaded binaries means the attacker can run any code, potentially leading to full system compromise, data theft, or persistence. The obfuscation and use of legitimate-looking filenames increase the risk of unnoticed exploitation.

No official patch or remediation is currently documented for this issue. Users should immediately stop using pvm-autodoc version 20.4.6 and remove it from their environments. Avoid installing or running this package until a trusted, verified version is released. Monitor for any unexpected execution of binaries named like Microsoft diagnostic tools in temporary directories. Patch status is not yet confirmed — check the vendor advisory or npm repository for updates on remediation.