The sme-scripts-cli npm package (version 20.5.3) includes malicious functionality where its index.js loads a script (_bridge.js) that detects the operating system and architecture, then downloads an OS-specific binary from hardcoded Cloudflare workers.dev endpoints using obfuscated hostnames and string concatenation to evade static analysis. The downloaded binary is saved to temporary directories under disguised names, permissions are set to executable (chmod 0755), and it is spawned detached via shell commands. No hash or signature verification is performed on the binary, increasing risk. Additionally, a second dropper variant is bundled in lib/telemetry.js disguised as a 'tracing.node' analytics SDK, which decodes base64 chunks from network content and uses similar execution primitives. This behavior effectively grants full control of the compromised system to an attacker.

Systems with sme-scripts-cli version 20.5.3 installed or running are considered fully compromised. The malicious code downloads and executes arbitrary binaries without verification, potentially allowing attackers full control over the affected system. All secrets and keys stored on the compromised machine should be assumed exposed and must be rotated from a separate, secure environment. Removing the package alone may not eliminate all malicious components due to the potential for persistent backdoors or additional malware installed by the dropper.

Immediate removal of the sme-scripts-cli package version 20.5.3 is required. All secrets, credentials, and keys stored on the affected system should be rotated immediately from a different, uncompromised device. Due to the high likelihood of full system compromise, a complete system rebuild or forensic investigation is recommended to ensure no residual malicious software remains. No official patch or fix is currently available; users should avoid this package version entirely.