The npm package [email protected] unconditionally loads a support script that dynamically reconstructs obfuscated hostnames to fetch a native executable over HTTPS from multiple mirrored endpoints. It writes this executable to temporary locations with deceptive names, sets permissions to executable, and spawns it detached using shell commands. The package also contains a telemetry module that implements similar base64 decoding, writing, permission setting, and spawning of executables, reinforcing the presence of a multi-stage loader. The use of DNS TXT-record fallback channels, runtime string reconstruction, and environment variable opt-out mechanisms are evasion techniques consistent with malicious intent.

This malicious package can execute arbitrary native code on the host system without user consent, potentially leading to full system compromise or persistence. The staged loader design and multi-mirror command and control infrastructure increase the difficulty of detection and removal. Although no known exploits in the wild are reported, the presence of a native dropper capable of executing arbitrary binaries poses a high risk to affected systems.

No official patch or remediation is currently available for this package version. Users should immediately remove [email protected] from their environments and avoid installing or using this package. Employ package integrity verification and source validation to prevent installation of malicious npm packages. Monitor for any suspicious processes spawned from temporary directories with deceptive names. Check vendor or npm advisories for updates or removal notices.