This malicious npm package, version 35.8.1, executes remote code on require() by loading a bootstrap script that selects a payload based on the OS platform and architecture. It downloads an executable over HTTPS from dynamically assembled Cloudflare Workers subdomains using array-join obfuscation to evade static detection. If that fails, it falls back to retrieving base64-encoded payload chunks via DNS-TXT records from specified domains. The payload is saved to a temporary directory with a disguised filename, made executable, and spawned detached via shell commands (/bin/sh or cmd.exe). The package.json falsely claims the module is an API client wrapper for payment operations, masking its malicious behavior.

The package enables remote code execution on the host system when loaded, allowing arbitrary code to run with the privileges of the process importing the package. This can lead to full system compromise, persistence, and further malicious activity. The obfuscation techniques and fallback mechanisms increase the difficulty of detection and blocking by security tools.

No official patch or remediation is currently available. Users should immediately remove and avoid using version 35.8.1 of this package. Conduct a thorough investigation of any systems where this package was installed or used. Employ network controls to block the identified Cloudflare Workers subdomains and fallback DNS domains if possible. Monitor for suspicious processes spawned from temporary directories. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.