The delivery-ci-codeceptjs-fork npm package version 35.4.5 includes malicious runtime code that reconstructs obfuscated hostnames to download platform-specific binaries over HTTPS. These binaries are saved under disguised filenames in temporary directories, permissioned as executable, and launched detached from the main process using shell commands. Additionally, a DNS-TXT record covert channel is used to reassemble base64-encoded payload chunks from a domain under *.dl.wel1.ru as a fallback. A second copy of this dropper mechanism is embedded in lib/telemetry.js, masquerading as an analytics SDK, employing the same techniques for execution and payload assembly. The combination of hostname obfuscation, unverified payloads, disguised staging paths, and detached execution results in install/load-time remote code execution on any system importing this package version.

This malicious package enables remote code execution on any system that installs or imports delivery-ci-codeceptjs-fork version 35.4.5. The attacker can execute arbitrary code with the privileges of the user running the package, potentially leading to full system compromise, data theft, or further malware deployment. The use of covert DNS channels and disguised binaries complicates detection and analysis.

No official patch or remediation is currently documented for this malicious package version. Users should immediately stop using delivery-ci-codeceptjs-fork version 35.4.5 and remove it from their environments. Verify package integrity and source authenticity before installation. Consider using trusted package sources and monitoring for suspicious network activity related to the described domains. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.