The 'delivery-ci-documentation' npm package (version 35.3.7) includes malicious functionality where its index.js loads _init.js, which selects a platform-specific payload endpoint. It reconstructs destination hostnames at runtime and downloads an opaque binary over HTTPS from suspicious hosts (oob-worker.cf10x-*.workers.dev). If HTTPS retrieval fails, it falls back to a covert DNS TXT channel that reassembles a base64-encoded payload from subdomains under *.dl.wel1.ru. The downloaded payload is saved to temporary directories with disguised filenames, permissions are set to executable, and the payload is executed detached from the parent process. There is no hash or signature verification, and the URLs and hosts used do not correspond to any legitimate publisher. This leads to arbitrary attacker-controlled code execution on the host importing the package.

An attacker can achieve arbitrary code execution on the system of any user who imports the affected version of the 'delivery-ci-documentation' package. This can lead to full compromise of the host environment, including execution of any malicious payload delivered via the covert channels described.

No official patch or remediation is currently documented. Users should avoid using the 'delivery-ci-documentation' package version 35.3.7. Since the package is malicious by design, removal and replacement with a trusted alternative is recommended. Monitor for and block network connections to the identified suspicious domains. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.