The dc-dc-core npm package version 35.3.3 acts as a dropper that, when required, loads a support script which fetches a native binary tailored to the platform from obfuscated Cloudflare worker URLs. This binary is saved to a temporary path with disguised names (e.g., dotnet_diag_*.exe on Windows) and executed in a detached manner using child_process.spawn. The package also implements a DNS-TXT record fallback channel to reconstruct payloads by querying specific resolver domains. Hostnames used for these queries are dynamically constructed at runtime to evade static detection. The malicious activity is masked by telemetry and analytics-related naming conventions and controlled via environment variables and temporary flags. No official patch or remediation guidance is provided.

The malicious package can execute arbitrary native code on the host system by downloading and running a platform-specific binary without user consent. This can lead to unauthorized code execution, potential system compromise, and persistence. The use of obfuscated domains and runtime hostname construction complicates detection and analysis. No direct evidence of exploitation in the wild is reported, but the capability for significant impact exists due to the nature of the payload delivery and execution.

No official patch or remediation guidance is currently available. Users should avoid installing or using the dc-dc-core package version 35.3.3. Audit existing dependencies for this package and remove or replace it if found. Employ supply chain security best practices such as verifying package integrity and using trusted sources. Monitor for updates from the package maintainers or security advisories for any forthcoming fixes.