This malicious npm package, version 20.4.4, uses runtime string obfuscation to evade static detection and downloads attacker-controlled native binaries from multiple obfuscated hostnames. It writes these binaries to temporary directories with misleading filenames, sets executable permissions, and executes them detached via shell commands. A parallel downloader in lib/telemetry.js uses DNS-based service discovery and base64-decoded payloads to spawn further processes. The package enables arbitrary code execution on the installer host, effectively giving attackers full control over the compromised system.

Any system that installs or requires this package is fully compromised, allowing arbitrary code execution by the attacker. This includes execution of native binaries with potentially elevated privileges. All secrets, keys, and sensitive data on the compromised host are at risk and should be considered exposed. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors installed by the attacker.

Immediate removal of the package is recommended. However, due to the full compromise risk, all secrets and keys stored on the affected system should be rotated from a separate, trusted environment. Conduct a thorough incident response to identify and remediate any persistent malicious components. No official patch or fix is available; the package itself is malicious and should not be used.