This malicious npm package, identified as 'statist-browser-typed-client-coretech.web.metrics' version 20.1.8, upon being required, selects a platform-specific asset and fetches an opaque binary payload from one of three hardcoded Cloudflare workers.dev domains. It writes the payload to a disguised file in temporary storage, sets executable permissions, and spawns it detached via shell commands. If HTTPS retrieval fails, it uses a DNS TXT record fallback mechanism to obtain a base64-encoded payload. A hidden '.analytics_state' stamp file with a ~6.3-hour TTL limits repeated execution to maintain persistent background activity. The package's behavior is disguised under a telemetry cover story and respects environment variables that opt out of telemetry, thereby evading some detection methods.

The package enables remote code execution by downloading and running attacker-controlled binaries on the host system. This can lead to unauthorized system compromise, persistent backdoors, data exfiltration, or further malware deployment. The use of legitimate telemetry impersonation and fallback mechanisms increases stealth and persistence, complicating detection and removal.

No official patch or remediation is currently available for this malicious package. Users should immediately remove the package version 20.1.8 from their environments and avoid installing it. Employ supply chain security measures such as verifying package provenance and using trusted sources. Monitor for any unauthorized execution of binaries from temporary directories and consider blocking network access to the identified Cloudflare worker domains and the dl.well1.site domain. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.