This threat involves a malicious npm package named statist-browser-typed-client-investing.product.loginandauthorization at version 20.7.3. The package's index.js unconditionally requires a module that selects a per-OS binary URL from obfuscated hostnames, downloads a payload over HTTPS, writes it to temporary directories under decoy filenames, sets executable permissions on POSIX systems, and spawns the binary detached from the main process. The obfuscation includes runtime-joined string arrays and dispersed child_process requires to evade detection. Any system that installs and imports this package executes attacker-controlled native code, resulting in full compromise.

Systems with this package installed and imported are fully compromised, allowing execution of arbitrary native code controlled by attackers. This compromises all secrets and keys stored on the affected computer. Removal of the package alone does not guarantee eradication of all malicious software introduced by the attacker.

Remove the malicious package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Due to the full system compromise risk, consider rebuilding the affected system to ensure complete remediation. Monitor for any persistence mechanisms or additional malware.