This malicious npm package version 20.2.8 unconditionally requires a polyfill script that constructs C2 hostnames at runtime to evade static detection. It fetches platform-specific binaries over HTTPS from these C2 domains, writes them to temporary directories with cover-story filenames, sets executable permissions, and executes them detached from the main process. The package also contains duplicate dropper code in a telemetry module disguised as an analytics SDK. Despite comments suggesting integrity checks and load distribution, no such protections are implemented. The malicious behavior is inconsistent with the package's declared purpose, indicating a supply chain compromise.

The package enables remote code execution by downloading and running arbitrary native binaries from attacker-controlled servers. This can lead to full system compromise on affected hosts where the package is installed and executed. The malicious code runs detached from the main process, making detection and remediation more difficult. The supply chain compromise risks downstream projects that depend on this package.

No official patch or remediation guidance is currently available. Users should immediately remove version 20.2.8 of this package from their environments and avoid installing it. Monitor for updates from the package maintainers or npm security advisories for any official fixes or further guidance. Consider auditing dependencies for similar malicious behavior.