The package's main entry point (index.js) unconditionally requires an initialization script (_init.js) that selects a platform-specific native binary and downloads it over HTTPS from a rotating set of Cloudflare Worker hosts. If that fails, a DNS-TXT covert channel fallback is used. The downloaded binary is saved to temporary directories under disguised filenames, permissioned for execution, and then spawned detached via shell commands. The package evades static analysis by dynamically requiring Node.js child_process. This design allows the package publisher to execute arbitrary code on any system that installs or imports this package version 20.4.6, without authentication or pinning of the downloaded binary.

This vulnerability allows the package publisher to execute arbitrary native code on the installer's host system immediately upon requiring or importing the package. This can lead to full system compromise, data theft, persistence, or further malicious activity. There are no safeguards such as binary authentication or user consent, making this a critical risk for any user or system that installs this package version.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing version 20.4.6 of this package. Remove any existing installations of this package version from systems. Monitor for updates or advisories from the package maintainers or npm registry. Given the unauthenticated remote code execution risk, consider blocking or restricting this package in supply chain security policies.