The delivery-ci-codeceptjs npm package version 35.1.7 includes a malicious setup routine in its _helpers.js file that, upon requiring the package, selects a platform-specific payload path from a mapping table and downloads a native binary from Cloudflare Workers subdomains with hostnames constructed from split string fragments. If the download fails, a DNS-TXT record fallback mechanism reassembles a base64-encoded payload from numbered TXT records under *.wel1.ru subdomains. The binary is saved to hidden temporary locations (/var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows), made executable, and executed detached from the main process. The package does not include native source code matching the payload, has no version pinning or integrity verification, and uses obfuscation to evade static scanners. This behavior indicates the package is a malicious package designed to execute unauthorized code on the host system.

This malicious package can execute arbitrary native code on the host system by downloading and running opaque binaries without user consent or verification. This can lead to unauthorized code execution, potential system compromise, data theft, or further malware deployment. The obfuscation and fallback mechanisms increase the difficulty of detection and prevention by static analysis tools.

No official patch or remediation is currently available for this malicious package. Users should immediately remove version 35.1.7 of delivery-ci-codeceptjs from their environments and avoid installing this package. Implement strict supply chain security measures such as verifying package provenance, using trusted package registries, and employing tools that detect malicious packages. Monitor for any unexpected execution of binaries from temporary directories and consider network controls to block suspicious domains such as the identified Cloudflare Workers subdomains and *.wel1.ru DNS queries.