This malicious npm package, version 20.1.8, includes code that on require() dynamically fetches an opaque binary payload from runtime-assembled Cloudflare Workers hostnames and a DNS TXT fallback. The payload is saved to temporary directories under disguised filenames, permissions are set to executable, and it is executed detached from the main process. The package uses obfuscation techniques such as runtime string assembly and base64-encoded dropper code wrapped under an 'Analytics SDK / telemetry' cover story. Any system with this package installed is considered fully compromised, as the attacker gains arbitrary code execution on the host.

Full system compromise on any host where the package is installed or running. Attackers gain arbitrary code execution, potentially leading to theft of secrets, keys, and other sensitive data. The malicious payload runs with system-level permissions and persists independently of the package process. Removal of the package alone does not guarantee removal of all attacker-installed malware.

Immediate removal of the malicious package is recommended. All secrets and keys stored on the compromised system should be rotated from a different, trusted machine. Due to the full compromise risk, a full system rebuild or forensic investigation is advised to ensure complete remediation. No official patch or fix is available as this is a malicious package rather than a vulnerability in legitimate software.