The 'trapp-configuration' npm package version 20.5.3 includes a malicious component in its _adapter.js file. This component dynamically constructs hostnames to download an opaque binary from Cloudflare Workers hosts, saves it to temporary directories with disguised filenames, sets executable permissions, and executes it detached via child_process spawn using system shells (/bin/sh or cmd). If the HTTP download fails, it falls back to a covert DNS-TXT channel to retrieve and reconstruct the binary payload from DNS TXT records under the domain *.dl.well1.site. There is no integrity verification of the downloaded binary. The use of hostname string-splitting and disguised filenames suggests intentional evasion rather than benign build behavior.

This malicious behavior allows arbitrary binary code execution on the host system where the package is installed, potentially leading to full system compromise. The lack of hash or signature verification increases the risk of executing tampered or malicious payloads. The covert DNS-TXT fallback channel further complicates detection and mitigation.

No official patch or remediation is currently documented. Users should avoid using version 20.5.3 of 'trapp-configuration'. Investigate and remove this package from affected environments. Monitor for any binaries or processes spawned from temporary directories with suspicious names. Check vendor advisories or trusted sources for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.