This malicious npm package version 35.8.1 uses obfuscation techniques to evade static analysis by reconstructing the 'child_process' identifier and destination hostnames from split string fragments. It downloads a binary payload from several Cloudflare Workers domains, writes it to a temporary location with hidden naming conventions, sets executable permissions, and executes it detached from the main process. When HTTPS download attempts fail, it falls back to a DNS-TXT record covert channel to fetch and execute the payload. The code masquerades as telemetry functionality with misleading comments and environment variable checks to avoid detection and analysis.

The package executes arbitrary binaries on the host system without verification, potentially allowing remote code execution and unauthorized control. This can lead to system compromise, data theft, or further malware deployment. The use of covert DNS channels and obfuscation increases the difficulty of detection and mitigation.

No official patch or remediation is currently available. Users should immediately remove and avoid using version 35.8.1 of this package. Conduct thorough audits of dependencies for malicious code. Employ runtime protections to detect and block unauthorized child process executions and network communications to suspicious domains. Monitor for unusual DNS TXT queries and network traffic to the specified Cloudflare Workers domains and sdk.dl.wel1.ru domains. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.