The ded-pwa-test-pub-pkg npm package version 35.8.4 includes malicious functionality in its index.js file. It dynamically constructs remote hostnames from split string literals and fetches a platform-specific binary via HTTPS GET requests from anonymous CDN endpoints and a DNS-TXT fallback domain. The binary is saved to a disguised file path in temporary directories (/tmp or %TEMP%) with executable permissions and then spawned detached using shell commands. Execution is gated by a stamp file to avoid repeated runs, and environment variables such as DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK are checked to skip execution in analysis environments. Logging calls are stubbed to empty strings to reduce detection. The payload runs with the privileges of the user installing the package, posing a significant risk.

The malicious code executes arbitrary platform-specific binaries with the installer's privileges, potentially allowing full system compromise or unauthorized actions on the affected host. The use of anonymous and mutable CDN endpoints for payload delivery and evasion techniques such as environment variable checks and execution gating increase the difficulty of detection and analysis. This can lead to unauthorized code execution, data compromise, or persistence on affected systems.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing ded-pwa-test-pub-pkg version 35.8.4. If already installed, remove the package and any related files from temporary directories. Monitor for suspicious processes spawned from temporary paths and network connections to unknown hosts. Verify package integrity and source before installation. Check vendor or repository advisories for updates or removal notices.