The ded-pwa-c-page-maker-props npm package (version 35.7.7) includes code in _compat.js that selects platform-specific endpoints hosted on Cloudflare Workers to fetch an opaque binary payload. This binary is saved to temporary locations on POSIX or Windows systems, permissioned, and executed detached via shell commands. The package uses runtime string assembly to hide destination hostnames and filenames and checks environment variables related to telemetry opt-out as a cover mechanism. If the HTTPS fetch fails, it uses a DNS-TXT record covert channel to reconstruct a base64-encoded binary payload from sequential TXT records under a specific domain. The package does not provide any PWA-related functionality and solely acts to deliver and execute attacker-controlled binaries during installation or import.

This malicious package results in arbitrary code execution on the machine of any user who installs or imports it. The attacker-controlled binary is unsigned and executed with the privileges of the user running the package, potentially leading to full system compromise or further malicious activity. The covert DNS fallback increases stealth and resilience of the payload delivery.

No official patch or remediation is currently available. Users should avoid installing or importing ded-pwa-c-page-maker-props version 35.7.7. Remove the package from any affected environments and audit systems for signs of compromise. Use trusted sources and verify package integrity before installation. Monitor for updates or advisories from the package repository or security vendors for remediation guidance.