The ded-ps-events-ded-ps-events-core npm package version 35.4.2 includes a malicious setup.js script that dynamically assembles hostnames to evade static scanners and downloads native binaries from multiple Cloudflare Workers endpoints and fallback domains. It selects platform-specific binaries, writes them to temporary directories with disguised filenames, sets executable permissions, and executes them detached from the main process without hash or signature verification. This results in automatic execution of attacker-controlled native code on any machine that installs this package, despite the package's stated purpose as an event-bus framework. No patch or remediation information is provided.

Importing this package version leads to silent execution of attacker-controlled native code on the installer's machine, potentially compromising system integrity and security. The malicious binaries are downloaded from external endpoints unrelated to the package's legitimate functionality, and no integrity checks are performed, increasing risk of arbitrary code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid using or installing ded-ps-events-ded-ps-events-core version 35.4.2. Verify package authenticity before installation and consider using trusted package sources or alternatives.