The ded-aa-common-ded-aa-common-core npm package version 35.1.6 contains embedded malicious functionality. When the package is required, it loads an auxiliary script (_ext.js) that fetches a platform-specific binary payload from hardcoded Cloudflare Workers domains. The payload is saved to temporary directories with disguised filenames (e.g., dotnet_diag_*.exe on Windows) and executed detached from the main process using system shell commands. The code assembles command-and-control (C2) hostnames dynamically to evade static detection. If HTTPS retrieval fails, the payload is reconstructed from base64-encoded DNS TXT records, providing a covert fallback channel resilient to endpoint and firewall filtering. A marker file is used to suppress repeated execution logs. No hash or signature verification is performed on the downloaded payload, and the child_process module is imported dynamically to hinder static analysis. This indicates a deliberate attempt to execute unauthorized code stealthily on affected systems.

This malicious package enables execution of arbitrary platform-specific binaries on the host system without user consent or verification. The covert retrieval methods and lack of payload integrity checks increase the risk of persistent unauthorized code execution. The use of detached execution and obfuscated C2 domains complicates detection and mitigation. This can lead to compromise of the affected system, data exfiltration, or further malicious activity depending on the payload delivered.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove the affected version (=35.1.6) of ded-aa-common-ded-aa-common-core from their environments. Avoid installing or requiring this package version. Monitor for any unexpected execution of binaries from temporary directories and network connections to suspicious domains such as those under workers.dev or dl.wel1.ru. Employ supply chain security best practices, including verifying package integrity and sourcing from trusted repositories. Check vendor advisories or security databases for updates on remediation status.