This malicious npm package, version 20.2.2, uses a loader script (_init.js) that dynamically reconstructs Cloudflare Workers hostnames to download a native binary over HTTPS. If HTTPS retrieval fails, it falls back to retrieving base64-encoded payload data from DNS TXT records across multiple domains. The binary is saved to a temporary file with a deceptive name, made executable, and spawned detached via shell commands. The binary is unsigned and unrelated to the package's stated SDK purpose, indicating malicious intent to execute unauthorized code on the host system.

The package executes an unverified native binary on the host system, which can lead to arbitrary code execution. This compromises the security and integrity of systems that install this package, potentially allowing attackers to run malicious payloads undetected. The use of covert DNS channels for payload delivery further complicates detection and mitigation.

No official patch or remediation is currently available. Users should immediately avoid installing or using version 20.2.2 of this package. Remove any existing installations of this version and audit systems for signs of compromise. Monitor for updates from the package maintainer or npm advisories for any official fixes or removals.