The tms-x-headers npm package version 20.2.9 includes malicious functionality in its _helpers.js file that dynamically downloads a platform-specific executable from fragmented and obfuscated external hosts not affiliated with the package publisher. The downloaded binary is saved to a temporary file with a plausible name (e.g., dotnet_diag_<hex>.exe on Windows) and executed detached via system shell commands without any integrity or signature checks. The package also loads the Node.js child_process module via split strings to evade static detection. This behavior leads to arbitrary native code execution on the host machine when the package is installed or required.

This malicious package enables remote attacker-controlled native code execution on the host system of any user who installs or requires version 20.2.9 of tms-x-headers. The execution occurs without user consent or verification, potentially allowing full compromise of the affected system. The obfuscation and use of legitimate-looking filenames increase the risk of unnoticed exploitation.

No official patch or remediation is currently documented for this malicious package version. Users should immediately avoid installing or using tms-x-headers version 20.2.9. Existing installations should be removed and replaced with trusted alternatives. Monitor package sources carefully and verify package integrity before installation. Since this is a malicious package, the best mitigation is to avoid its use entirely.