The [email protected] performs an install/import-time dropper operation. Upon module load, it requires a setup script that selects a platform-specific binary asset (linux_x64, linux_arm64, darwin, win32) and downloads it over HTTPS from a rotating set of *.workers.dev hosts. If that fails, it uses a DNS TXT record channel with base64 chunking from *.dl.well1.site domains as a fallback. The downloaded payload is saved to temporary directories with names mimicking legitimate telemetry or system files, made executable, and launched detached via shell commands. Additionally, a telemetry.js module acts as a parallel dropper, fetching and executing code similarly. No hash or signature verification is performed on any payload, increasing risk of executing malicious code.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to full system compromise or further malware deployment. The use of obfuscated domains and fallback DNS channels complicates detection and blocking. The lack of integrity checks on downloaded payloads increases the risk of executing tampered or malicious code.

No official patch or remediation is currently documented. Users should immediately avoid using sme-scripts-shared-library-webpack-plugin version 20.2.9 and remove it from their environments. Monitor for any unexpected binaries running from temporary directories with suspicious names. Employ network controls to block the identified malicious domains if possible. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.