The 'saas-f-testing' npm package version 20.4.2 includes malicious functionality where the main script (index.js) loads setup.js, which downloads an executable payload from runtime-assembled and obfuscated hostnames. The payload is saved to temporary directories with disguised filenames, permissioned to be executable (chmod 0755), and executed detached via shell commands without any integrity verification. The hostnames and child process invocation are constructed dynamically to evade static analysis. Additionally, a secondary file (lib/telemetry.js) contains similar malicious code but is not invoked in this version. This behavior indicates a supply chain compromise or deliberate inclusion of malware in the package.

This malicious code can result in arbitrary code execution on any system that installs and requires this specific version (20.4.2) of the 'saas-f-testing' npm package. The downloaded executable runs without verification, potentially allowing attackers to execute any payload, leading to system compromise, data theft, or further malware deployment. There is no indication of active exploitation in the wild yet.

No official patch or remediation is currently documented. Users should avoid using version 20.4.2 of the 'saas-f-testing' npm package. It is recommended to audit dependencies for malicious code and remove or replace this package until a vendor advisory or patch is available. Monitor for updates from the package maintainer or npm security advisories for remediation guidance.