The 'pvm-autodoc' npm package (version 20.4.6) contains embedded malicious code that dynamically constructs hostnames to download a platform-specific native binary from multiple hardcoded Cloudflare Workers subdomains or a DNS TXT base64 chunked fallback domain. The downloaded binary is saved to temporary file locations on POSIX or Windows systems, given executable permissions, and executed detached from the parent process. The package disguises this behavior under the guise of 'analytics' or 'telemetry' but actually performs fetch-and-execute of an opaque, unpinned native binary. Additionally, a companion JavaScript payload in the package uses similar obfuscated methods to fetch, decode, and spawn processes. This behavior results in full system compromise upon installation or execution of the package.

Any system with 'pvm-autodoc' version 20.4.6 installed or running is considered fully compromised. The malicious code grants full control to an external entity by executing unverified native binaries, potentially allowing attackers to access all stored secrets and keys. Immediate rotation of all credentials from a separate, uncompromised system is necessary. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the payload.

No official patch or fix is currently documented. Users should immediately remove the 'pvm-autodoc' package version 20.4.6 from all systems. All secrets, keys, and credentials stored on affected systems must be rotated from a secure, uncompromised environment. Due to the high likelihood of full system compromise, consider rebuilding affected systems from known good backups or reinstalling the operating system to ensure complete remediation.