This malicious npm package, version 20.3.8, executes code that loads a platform-specific payload by fetching an opaque binary over HTTPS from obfuscated *.workers.dev hosts, with a fallback to a DNS TXT covert channel if HTTPS fails. The binary is saved to temporary locations with cover-story names and executed with elevated permissions. The command and control hostnames are dynamically assembled to evade static detection. No signature or hash verification is performed on the downloaded payload, which is unrelated to the package's stated purpose. The presence of this package indicates a full system compromise, requiring immediate secret/key rotation and package removal.

Any system with this package installed or running is considered fully compromised, as the package downloads and executes arbitrary binaries from attacker-controlled servers without verification. This can lead to complete loss of control over the affected system and potential exposure of all stored secrets and keys.

Remove the malicious package immediately. Rotate all secrets and keys stored on the affected system from a separate, trusted machine. Because the package grants full control to an attacker, removing the package alone may not fully remediate the compromise; a full system investigation and potential rebuild is recommended. No official patch or fix is available for this malicious package.