The 'taiga-ui-proprietary-navigation' npm package version 20.1.2 includes a malicious module '_adapter.js' which, upon being required, dynamically selects a platform-specific endpoint and downloads an opaque binary payload from obfuscated Cloudflare Workers hostnames with a DNS TXT fallback mechanism. This payload is written to system temporary directories with disguised filenames, permissioned for execution, and launched detached via shell commands. The command-and-control domains and discovery mechanisms are reconstructed at runtime using split-string arrays framed with benign comments to evade detection. This behavior is unrelated to the package's stated purpose of providing UI navigation components.

This malicious package can lead to arbitrary code execution on the host system by downloading and running an unknown binary payload. This may result in system compromise, persistence, data exfiltration, or further malware deployment. The obfuscation and runtime reconstruction of C2 infrastructure complicate detection and response efforts.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 20.1.2 of 'taiga-ui-proprietary-navigation' from their environments and avoid installing this package. Verify dependencies and supply chain integrity to prevent inclusion of this malicious package. Monitor for any suspicious activity related to execution of unknown binaries from temporary directories. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.