The npm package statist-browser-typed-client-social.shorts.editor version 20.7.1 is malicious. Its index.js unconditionally loads a runtime script that fetches a platform-specific binary from rotating Cloudflare Workers subdomains with a DNS-TXT fallback from an unrelated domain. This binary is written to a temporary directory under a disguised name, permissioned as executable, and spawned detached via shell commands. The package uses runtime string assembly to evade static detection. Additionally, a secondary module lib/telemetry.js acts as an analytics SDK facade but contains the same base64 decode, chmod, and detached spawn dropper functionality. The delivery infrastructure is anonymous and attacker-controlled, and the executed payload is opaque. Installing or loading this package leads to arbitrary code execution on the host as a detached background process.

Installing or importing the affected package version results in arbitrary code execution on the host system. The malicious payload runs as a detached background process, potentially allowing attackers to execute any code without user consent or awareness. This compromises the integrity and security of the host environment.

No official patch or remediation is currently documented. Users should avoid installing or importing version 20.7.1 of statist-browser-typed-client-social.shorts.editor. Verify package authenticity before use and consider removing this package if already installed. Monitor vendor advisories for updates or official fixes. Since this is not a cloud service, remediation depends on user action.