This malicious npm package version 20.5.8 unconditionally requires a script that detects the operating system and architecture, then constructs obfuscated destination hostnames to evade static detection. It downloads a platform-specific binary from these attacker-controlled domains, writes it to temporary directories with names resembling system files, sets executable permissions, and executes it detached from the main process. A sibling file contains similar dropper functionality under the guise of an analytics SDK, indicating staged variants. The malicious code executes automatically upon importing the package, causing any consumer who installs and loads it to run attacker-controlled binaries on their host.

Any user or system that installs and imports this specific version of the package will execute attacker-controlled binaries, potentially leading to full system compromise or unauthorized actions. The malicious binaries run detached and are disguised as legitimate OS files, increasing stealth. This can result in unauthorized code execution and persistence on affected hosts.

No official patch or remediation is currently documented. Users should avoid installing or importing version 20.5.8 of this package. Conduct thorough audits of dependencies to detect and remove this malicious package. Monitor for any updates or advisories from trusted sources regarding remediation. Patch status is not yet confirmed — check the vendor advisory or trusted security databases for current remediation guidance.