The ded-pwa-c-micro npm package (version 35.8.3) includes malicious functionality in its index.js file, which loads a shim that selects and downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers domains. The domains and DNS fallback channels are constructed dynamically via split-string arrays, complicating detection. The downloaded binary is saved to temporary directories with masquerading filenames, permissioned to be executable, and then spawned detached from the main process with no integrity checks such as pinning, hashing, or signature verification. The code includes misleading comments and naming to disguise its telemetry and analytics behavior, indicating intentional obfuscation and malicious intent.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to unauthorized code execution and compromise of the affected environment. The lack of integrity checks and obfuscation increases the risk of undetected malicious activity.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove ded-pwa-c-micro version 35.8.3 from their environments and avoid installing it. Use trusted sources and verify package integrity before installation. Monitor for any unexpected processes spawned from temporary directories with suspicious naming patterns.