The malicious npm package statist-browser-typed-client-ddp.mentat.ui.web (version 20.9.4) includes code that, when required, downloads a native binary payload from multiple obfuscated HTTPS endpoints. The payload is saved to temporary directories with disguised names, permissioned for execution, and launched in a detached process. A fallback mechanism uses DNS TXT records to reconstruct the payload. A second dropper module under the guise of an analytics SDK uses string splitting to evade static analysis. This results in full compromise of any host running this package, granting attacker-controlled code execution.

Any computer with this package installed or running is considered fully compromised, as the package downloads and executes attacker-controlled native binaries with no restrictions. This can lead to complete loss of confidentiality, integrity, and availability of the affected system. All secrets and keys stored on the compromised machine should be assumed exposed and rotated immediately from a secure environment. Removal of the package alone does not guarantee eradication of all malicious components.

No official patch or fix is currently available. Immediate removal of the package is recommended. All credentials and secrets stored on the affected system should be rotated from a different, uncompromised machine. Due to the nature of the compromise, a full system rebuild or forensic analysis is advised to ensure complete remediation. Monitor for any suspicious activity related to the obfuscated domains and payload execution patterns described.