The travel-core-utils-object npm package version 20.3.4 has a malicious main entry point (index.js) that requires a side-effect module (_bridge.js). This module dynamically constructs URLs from DNS TXT records and string operations to fetch an opaque binary payload over HTTPS from multiple Cloudflare Workers domains. The binary is saved to /var/tmp or %TEMP% with disguised names, permissions are set to executable (chmod 0755), and it is executed detached via shell commands. The binary is attacker-controlled, unpinned, and unverified, running with the privileges of the user installing the package. The package attempts to mask its activity with telemetry-related environment variable checks and files, which are unrelated to its stated utility purpose.

An attacker can execute arbitrary code on the system with the privileges of the user installing the package, potentially leading to full system compromise or persistence. The malicious payload is fetched dynamically from attacker-controlled infrastructure, making detection and static analysis difficult. The execution of unverified binaries poses a significant risk of unauthorized access and control.

No official patch or remediation is currently documented. Users should avoid using travel-core-utils-object version 20.3.4 and remove it from their environments. Monitor for any suspicious binaries in temporary directories named with the described patterns. Since the package fetches and executes unpinned binaries, blocking network access to the specified Cloudflare Workers domains and related URLs may help mitigate risk. Check vendor advisories or trusted security sources for updates or patches.