The sme-crm-services-sme-crm-services-core npm package version 20.1.4 includes malicious code that, upon require(), loads a secondary script which selects an OS/architecture-specific URL from fragmented Cloudflare Workers subdomains and downloads an unverified binary over HTTPS. This binary is written to temporary directories with disguised filenames, permissioned as executable, and executed detached via shell commands. The package employs obfuscation by splitting strings for API calls and assembling hostnames from fragments to evade static analysis. Execution is rate-limited using environment variables and a local analytics state file. The downloaded binary and its source are anonymous and unrelated to the package publisher, indicating a supply chain compromise or deliberate malware insertion.

This malicious package can execute arbitrary binaries on the host system with the permissions of the running process, potentially leading to full system compromise, data exfiltration, or persistence. The unverified and opaque nature of the downloaded binary increases risk as its behavior is unknown and could include any malicious payload. The obfuscation techniques hinder detection and analysis, increasing the likelihood of successful infection. Since the binary executes detached, it may evade some runtime monitoring tools.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 20.1.4 of sme-crm-services-sme-crm-services-core from their environments and avoid installing it. Consider auditing dependencies for this package and replacing it with a trusted alternative. Monitor for any unusual processes or binaries matching the described patterns in temporary directories. Check vendor advisories or trusted security sources for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.