This malicious npm package version 20.8.2 executes native code on the host by downloading platform-specific binaries from obfuscated Cloudflare Workers domains and executing them with elevated privileges. It uses runtime string reconstruction, writes binaries to temporary directories with decoy filenames, and spawns them detached to evade detection. A DNS-TXT covert channel provides a fallback method for payload delivery. A duplicate dropper is included in the package under lib/telemetry.js. The package's side-effect on require() leads to full system compromise, allowing attackers to control the affected machine.

Any system that installs or runs this package is fully compromised, allowing attackers to execute arbitrary native code with the privileges of the user running the package. This can lead to theft of secrets, keys, and complete system control. Removal of the package alone may not eliminate all malicious artifacts or backdoors, necessitating secret/key rotation and potentially full system remediation.

Remove the malicious package immediately. Rotate all secrets and keys stored on the compromised machine from a separate, trusted device. Due to the nature of the compromise, full system remediation may be required as removing the package does not guarantee removal of all malicious components. Monitor for any suspicious activity and consider rebuilding the affected system if possible.