The specials-mvno-client npm package version 20.9.8 includes a malicious module that, upon installation or require, downloads an opaque binary from Cloudflare Workers and other suspicious domains. This binary is written to temporary directories with disguised filenames, permissioned to execute, and launched detached from the main process. The package uses hostname assembly to evade string detection and a DNS-TXT fallback channel to deliver code when HTTPS is unavailable. It also attempts to evade analysis by honoring environment variables that disable telemetry or tracking. The malicious code is not hosted by the package publisher and executes on every install or require, effectively compromising any system using this package.

Systems with the affected package installed are considered fully compromised. The malicious code grants an external entity control over the affected system by executing opaque binaries fetched from attacker-controlled domains. This can lead to complete system compromise, including unauthorized access to secrets and keys stored on the system. Removal of the package alone does not guarantee eradication of the malicious software or backdoors introduced by the attacker.

Immediate removal of the specials-mvno-client package version 20.9.8 is recommended. All secrets, credentials, and keys stored on the compromised system should be rotated from a different, trusted device. Due to the high likelihood of full system compromise, a full incident response investigation and system rebuild may be necessary. Patch status is not confirmed; no official fix or remediation is indicated in the advisory. Users should avoid using this package version and monitor for updates from the package publisher or security advisories.