@torbeck/heap is a malicious npm package designed to impersonate the legitimate @datastructures-js/heap package by copying its README and metadata. It re-exports the genuine Heap class to appear functional but appends an obfuscated payload that triggers on require. This payload decrypts a concealed URL, downloads a binary to the OS temporary directory, sets execution permissions, and spawns the binary detached from the parent process. The binary is platform-specific (Windows, Linux, macOS) and unrelated to heap data structures. There is no signature or version verification on the downloaded payload. This results in an install-time remote code execution dropper, effectively compromising any system that installs or runs this package.

Systems that have installed or run @torbeck/heap are fully compromised due to the remote code execution capability of the malicious payload. Attackers gain persistent, stealthy control by downloading and executing arbitrary binaries without user consent. All secrets, credentials, and keys stored on the compromised system should be considered exposed and require immediate rotation. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the payload.

Immediate removal of the @torbeck/heap package is required. All secrets and credentials on affected systems must be rotated from a trusted environment. Due to the high likelihood of full system compromise, a complete forensic investigation and system rebuild are recommended. There is no official patch or fix for this malicious package; prevention relies on avoiding installation of typosquatting or untrusted packages and using package integrity verification tools.