The delivery-ci-cli package (version 35.3.5) includes a malicious _bootstrap.js script that downloads a native binary from obfuscated Cloudflare Workers domains, writes it to temporary directories under misleading filenames, sets executable permissions, and executes it detached from the parent process. If HTTPS-based download fails, it falls back to retrieving the payload via DNS-TXT record queries from several domains, concatenates and base64-decodes the response, writes it to disk, and executes it. Hostnames and API names are dynamically assembled at runtime to evade static detection. The package README falsely presents the tool as a benign continuous integration CLI SDK with no dependencies, serving as a cover for its malicious dropper functionality.

This malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The lack of signature or hash verification and use of covert DNS channels increases stealth and persistence risks. No known exploits in the wild are reported yet.

No official patch or remediation is currently available. Users should avoid installing or using delivery-ci-cli version 35.3.5. Verify package integrity and source before installation, and consider removing this package if present. Monitor for updates from the package maintainer or npm registry for remediation announcements. Since this is not a cloud service, remediation depends on user action.