The delivery-ci-core npm package (version 35.3.7) includes malicious code embedded in index.js and lib/telemetry.js. The code dynamically constructs Cloudflare Workers hostnames and uses DNS TXT-record fallbacks to retrieve a base64-encoded payload. It downloads platform-specific native binaries, writes them to temporary directories under decoy filenames, sets executable permissions, and spawns them detached via shell commands. Obfuscation techniques such as string splitting are used to evade static analysis. Installing or importing this package results in execution of attacker-controlled native code on the host system without any user interaction beyond requiring the package.

This malicious package enables remote code execution on the host system of any user who installs or imports delivery-ci-core version 35.3.7. The attacker-controlled native binaries can perform arbitrary actions with the privileges of the user running the package, potentially leading to full system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing or importing delivery-ci-core version 35.3.7. It is recommended to audit dependencies for malicious packages and remove this package if found. Use trusted sources and verify package integrity before installation.