The malicious npm package [email protected] loads a loader script at runtime that dynamically constructs C2 hostnames to evade static detection. It downloads a platform-specific binary from these C2 servers, saves it under disguised random filenames in temporary directories, sets executable permissions on Unix systems, and executes it detached via shell commands. The package uses marker files and environment variables to falsely present its activity as telemetry or analytics. The downloaded binary is unrelated to the package's stated functionality and enables full remote control of the compromised system.

Systems with this package installed are fully compromised, allowing remote attackers to execute arbitrary code via the downloaded binary. This can lead to complete system takeover, data theft, and unauthorized access to secrets and keys stored on the system. The presence of this package indicates a severe security breach requiring immediate response.

Remove the malicious package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised systems from a secure, unaffected environment. Because the package enables full remote control, assume the system is fully compromised and consider rebuilding or thoroughly cleaning the system. There is no known patch or fixed version; remediation requires removal and incident response.