[email protected] is a malicious npm package that executes a remote code execution payload upon being required. It fetches an opaque binary from a rotating set of Cloudflare Workers subdomains, using DNS TXT record fallbacks, decodes and writes the payload to temporary files with names mimicking cache or diagnostic files, sets executable permissions, and spawns the process detached from the parent. The package uses string concatenation and array joins to evade static detection. The payload execution is gated by a TTL marker file to avoid repeated execution. There is no signature or hash verification of the downloaded payload, allowing arbitrary code execution. Any system importing this package is considered fully compromised.

Systems with [email protected] installed or running are fully compromised, allowing an attacker to execute arbitrary code remotely. This can lead to complete system takeover, theft of secrets and keys, and persistent backdoors. The malicious payload runs with the privileges of the importing process and can evade detection through obfuscation and execution gating. Removal of the package alone does not guarantee eradication of the compromise.

Remove the specials-resources-server package version 35.8.1 immediately from all affected systems. Rotate all secrets and keys that were stored or accessible on compromised systems using a separate, clean environment. Due to the potential for persistent compromise, conduct a thorough incident response and forensic analysis to identify and eradicate any additional malicious artifacts. Monitor for any suspicious activity related to this package. Patch status is not confirmed; no official fix or patch is available. Avoid using this package and audit dependencies for similar malicious code.