This malicious npm package named statist-browser-typed-client-rubliq.platform.keycloak executes a binary dropper when loaded. The dropper reconstructs obfuscated destination hostnames to download binaries over HTTPS from Cloudflare Workers hosts. If HTTPS fetching fails, it uses a DNS-TXT record covert channel to reassemble a base64-encoded binary from TXT record chunks. The downloaded binaries are written to temporary directories under disguised filenames, permissions are set to executable, and the binaries are spawned detached using platform-specific shell commands. The code employs evasion techniques such as dynamic string concatenation to hide module and function names from static analysis. Environment variables related to telemetry are checked to provide a cover story for its behavior. The package does not implement any legitimate Keycloak client functionality but instead performs arbitrary code execution on the installer system.

The package enables arbitrary code execution on the system where it is installed by dropping and running binaries without user consent. This can lead to full system compromise, persistence, and potentially further malicious activities depending on the payload. The malicious behavior is triggered simply by requiring the package, posing a high risk to any project that installs or uses this package.

No official patch or remediation is currently documented. Users should avoid installing or using the statist-browser-typed-client-rubliq.platform.keycloak package, especially version =20.2.5. Remove any instances of this package from projects and dependency trees. Conduct audits of npm dependencies to detect and exclude this malicious package. Monitor for any updates or advisories from npm or security vendors regarding this package for potential remediation.