The ded-pwa-c-mapping npm package version 35.8.7 includes a malicious helper script (_helpers.js) that, when the package is required, selects a platform-specific native binary payload fetched over HTTPS from obfuscated workers.dev and dl.wel1.ru domains. The payload is downloaded without hash or signature verification, saved under disguised names in temporary directories (/var/tmp or %TEMP%), permissioned as executable, and spawned detached via shell commands. Hostnames are constructed at runtime by joining fragments to evade string-based detection, and a marker file is used to throttle repeated execution. The code references opt-out environment variables to masquerade as telemetry collection. This behavior constitutes a supply chain compromise through a malicious package.

This malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, persistence, or further malware deployment. The lack of payload integrity checks and obfuscation techniques increase the risk of undetected exploitation. Since the payload runs detached from the installing process, it can evade some detection mechanisms. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available. Users should immediately remove the affected version (=35.8.7) of the ded-pwa-c-mapping package from their environments. Avoid installing or requiring this package version. Monitor for any unusual processes spawned from temporary directories with disguised names. Consider using package integrity verification tools and restrict network access to suspicious external hosts. Check vendor advisories or trusted security sources for updates or fixes.