This malicious npm package, identified as 'twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info' version 20.5.1, executes a hidden native binary downloaded from obfuscated Cloudflare Workers domains and a DNS TXT record fallback. The binary is saved with disguised names in temporary directories, permissioned to execute, and launched detached from the main process. The package uses obfuscation techniques such as splitting strings and joining them to evade static detection. It falsely claims to provide API client bindings but instead acts as a dropper implanting potentially persistent malware. The presence of this package indicates full system compromise, requiring immediate secret rotation and comprehensive remediation.

Any system with this package installed or running is considered fully compromised. The malicious code grants remote attackers control by downloading and executing arbitrary native binaries. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the package.

Remove the malicious package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised machines from a separate, trusted environment. Conduct a thorough investigation and remediation of the affected systems to identify and remove any persistent malicious components. There is no official patch or fix for this package as it is inherently malicious; prevention involves avoiding installation and use of this package.