This malicious npm package version 35.8.1 loads a platform-specific asset path and downloads executable payloads from a rotating set of Cloudflare Workers endpoints, with a DNS TXT record fallback under a suspicious domain. The payload is written to temporary directories with disguised names impersonating legitimate system files, permissions are set to allow execution, and it is launched detached from the main process. The code uses runtime string assembly to evade static inspection and includes redundant payload delivery via a telemetry module. A filesystem stamp prevents multiple executions of the payload on the same host.

The package enables remote code execution on the host by downloading and executing arbitrary payloads from attacker-controlled infrastructure. This can lead to full system compromise, persistence, and potentially further malicious activity. The evasion techniques and disguised payloads increase the difficulty of detection and removal.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or removal guidance is available, users should avoid using version 35.8.1 of this package. Investigate and remove the package if already installed and monitor for suspicious activity related to the described payload delivery behavior.