The ded-aa-liza-ded-aa-liza-core npm package version 35.2.5 contains malicious code that triggers on import. It loads an internal script (_ext.js) which dynamically constructs hostnames to download a platform-specific binary from multiple obfuscated Cloudflare Workers endpoints and fallback DNS TXT records. The downloaded payload is stored in temporary directories under filenames designed to appear as legitimate diagnostic tools, then made executable and executed detached via shell commands. This behavior occurs immediately on require() and does not provide any legitimate functionality related to type definitions as advertised.

This package executes an opaque remote binary on the host system without user consent or awareness, potentially allowing arbitrary code execution. The downloaded payload could perform any malicious activity depending on its design, posing a significant risk to the host environment. Because the binary is fetched from external, obfuscated endpoints and executed with elevated privileges, this represents a critical security risk.

No official patch or remediation is indicated for this package version. The best mitigation is to avoid installing or using ded-aa-liza-ded-aa-liza-core version 35.2.5. Remove any existing installations of this package and audit systems for the presence of the downloaded binaries in temporary directories. Use trusted package sources and verify package integrity before installation.