The scandoc-scandoc-core npm package (version 20.8.5) includes malicious code that, upon require(), loads a vendor script which fetches platform-specific binaries from Cloudflare Workers hostnames reconstructed at runtime. It also uses a DNS-TXT covert channel fallback to retrieve base64-encoded payloads. These payloads are saved to temporary files named to resemble legitimate .NET diagnostic artifacts, given executable permissions, and executed detached from the main process. Execution is controlled by environment variables and a freshness marker to limit re-execution. Additionally, a secondary dropper module named telemetry.js is included, which uses obfuscated child process spawning to execute further payloads under the guise of an analytics SDK. This behavior effectively grants full control of the compromised system to an attacker.

Systems with this package installed or running are fully compromised, allowing an attacker to execute arbitrary code with the privileges of the user running the package. This can lead to complete system takeover, unauthorized access to secrets and keys, and persistent malicious activity. Removal of the package alone does not guarantee eradication of all malicious components, as the attacker may have established additional footholds.

Immediate removal of the scandoc-scandoc-core package version 20.8.5 is required. All secrets, keys, and credentials stored on the compromised system must be rotated from a separate, trusted machine. Due to the high likelihood of full system compromise, a full system forensic analysis and potential rebuild is recommended. Patch status is not confirmed; no official fix or updated version is indicated. Monitor vendor advisories for any updates or remediation guidance.