This npm package, version 20.9.9, includes malicious code that dynamically reconstructs Cloudflare workers.dev hostnames and fallback domains to download platform-specific binaries. It writes these binaries to temporary locations with misleading names, sets executable permissions, and executes them detached from the parent process. A secondary dropper in telemetry.js repeats this behavior under the cover story of an Analytics SDK, using runtime string manipulation and base64 chunk assembly to evade static detection. The package lacks publisher-owned hosts, version pinning, or hash verification, indicating deliberate obfuscation and malicious intent. The compromise is severe enough that any system running this package should be considered fully compromised.

Any computer with this package installed or running is considered fully compromised, potentially allowing attackers full control over the system. All secrets and keys stored on the compromised machine are at risk and must be rotated immediately from a separate, trusted device. Removing the package alone may not eliminate all malicious components or backdoors introduced by the malware.

Immediate removal of the malicious package is required. All secrets, credentials, and keys stored on the affected system should be rotated from a different, uncompromised machine. Due to the high likelihood of full system compromise, a thorough forensic analysis and system rebuild are recommended. No official patch or fix is available for this malicious package; prevention relies on avoiding installation and use of this package.