The 'contract-contract-builder' npm package (version 35.5.2) includes malicious functionality in its _platform.js file. Upon requiring the package, it downloads a platform-specific binary from Cloudflare Workers hosts whose domain names are constructed at runtime from split string fragments. The binary is saved to temporary directories (/tmp or %TEMP%) under disguised filenames, permissions are set to executable (0755), and it is spawned detached using shell commands or Windows equivalents. If HTTPS delivery of the binary fails, the package uses a DNS TXT record fallback mechanism from the domain *.dl.wel1.ru to reassemble a base64-encoded payload from multiple numbered TXT records. This binary execution occurs automatically on import, and the binary is unpinned and unverified, posing a significant risk. The package misrepresents itself as a UI toolkit, but the actual behavior is malicious code execution.

This malicious package can execute arbitrary code on the host system without user consent or verification, potentially leading to full system compromise. The use of dynamically assembled download URLs and a DNS TXT fallback channel complicates detection and blocking. Because the binary is executed detached and with executable permissions, it can persist and operate stealthily. This behavior undermines trust in the package and any projects depending on it, potentially exposing systems to malware, data theft, or further compromise.

No official patch or remediation is currently documented. Users should immediately remove and avoid using 'contract-contract-builder' version 35.5.2. Audit existing projects for this package and replace it with trusted alternatives. Monitor for any unexpected binaries or processes spawned from temporary directories. Since the package executes code on import, avoid importing or installing untrusted packages. Check vendor advisories or npm security advisories for updates or removal notices. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.