The package's main entry point (index.js) requires an initialization script (_init.js) that selects a platform-specific native binary and downloads it over HTTPS from a set of Cloudflare Worker hosts, with a DNS-TXT covert-channel fallback. The binary is saved to temporary directories under disguised filenames, given executable permissions on POSIX systems, and executed detached via shell commands. The package dynamically loads Node.js child_process to evade static analysis. This results in automatic, unauthenticated remote code execution on any system that imports or requires this package version.

Any user or system that installs or imports version 20.4.6 of this package is at risk of arbitrary code execution by the package publisher, potentially leading to full system compromise. The malicious binary is downloaded and executed without user consent or verification, bypassing typical security controls that rely on package integrity or static code inspection.

No official patch or remediation is currently documented. Users should avoid installing or importing version 20.4.6 of this package. Consider removing it from existing environments and replacing it with trusted alternatives. Monitor for updates from the package publisher or security advisories for any forthcoming fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.