The malicious npm package travel-core-typings-reducers (version 20.7.8) executes a multi-stage attack by loading an auxiliary script (_ext.js) that downloads a platform-specific binary payload from runtime-assembled Cloudflare workers.dev hostnames. The payload is also retrievable via a DNS-TXT covert channel fallback from subdomains of dl.well1.site, which reassembles base64-encoded chunks into executable code. The payload is saved to temporary directories with disguised filenames, made executable, and launched detached from the main process using shell commands. The package attempts to evade detection by dynamically constructing C2 hostnames and including unreferenced telemetry-related code and environment variables as decoys.

Successful execution of this malicious package results in arbitrary code execution on the host system, potentially allowing attackers to run unauthorized binaries with the privileges of the user running the npm package. The use of covert DNS-TXT channels and dynamic hostname assembly complicates detection and analysis. This can lead to system compromise, persistence, and further malicious activity.

No official patch or remediation guidance is provided for this malicious package. Users should avoid installing or using travel-core-typings-reducers version 20.7.8. If already installed, remove the package immediately and scan affected systems for the presence of the downloaded payloads in temporary directories. Monitor for suspicious processes spawned from temporary locations. Employ supply chain security best practices such as verifying package integrity and using trusted sources.