The @wololasod/tiny-id npm package versions 0.1.0, 0.1.1, and 0.1.3 contain an obfuscated loader that, upon import, determines the platform and downloads a remote executable to a temporary or APPDATA directory. It then executes this payload using child_process.spawn, employing a VBS launcher on Windows and direct spawn on Linux, followed by deletion of the staged file. The loader re-launches itself as a detached, hidden process that survives the parent process. The obfuscation includes RC4-decoded string arrays, hex-named identifiers, integrity checks on native code functions, and a caller-hash gate that crashes if the code is reformatted. Additionally, the malicious dropper is embedded in the dist/index.d.ts file, which is supposed to contain only TypeScript type declarations, not executable code. None of these actions relate to the package's stated purpose of generating tiny IDs.

Users who install and import the affected versions of @wololasod/tiny-id risk executing a hidden, persistent malicious payload downloaded from a remote server. This can lead to unauthorized code execution on the host system, potentially compromising system integrity and confidentiality. The malicious process is designed to evade detection by running detached and hidden, complicating incident response.

No official patch or remediation is currently documented for this package. Users should immediately cease using the affected versions (=0.1.0, =0.1.1, =0.1.3) of @wololasod/tiny-id. Remove the package from any projects and replace it with a trusted alternative. Monitor for any processes matching the described behavior and investigate systems where this package was installed. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.