The tramvai-module-feature-toggle package (version 20.5.3) is a malicious npm package that, upon require(), loads a setup script which downloads a platform-specific binary from hardcoded Cloudflare Workers domains. This binary is saved to a hidden temporary path, given executable permissions, and executed detached via /bin/sh. The package uses obfuscation by assembling destination hostnames at runtime and employs a fallback covert channel via DNS TXT records if HTTPS fetch fails. Execution is controlled by opt-out environment variables and a cooldown lockfile. The package mimics the legitimate tramvai ecosystem but contains no real functionality beyond the drop-and-execute behavior. Any system with this package installed should be considered fully compromised.

Installation of this package results in full compromise of the affected system. The attacker gains the ability to execute arbitrary code via the downloaded binary. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a different, uncompromised system. Removing the package alone does not guarantee removal of all malicious components or persistence mechanisms.

Remove the tramvai-module-feature-toggle package version 20.5.3 immediately. Rotate all secrets and keys that may have been exposed on the compromised system from a separate, secure environment. Conduct a thorough investigation for additional persistence or malware installed by the attacker. There is no official patch or fix available; remediation requires removal and incident response.