The delivery-ci-jira npm package version 35.5.2 includes a malicious module (_vendor.js) that dynamically downloads a platform-specific binary from a rotating set of obfuscated Cloudflare Workers URLs, with a base64-over-DNS TXT fallback mechanism. The downloaded binary is saved to a temporary location with a disguised filename, permissions are set to executable, and it is launched detached from the main process using a shell spawn call. The package employs string splitting to reconstruct hostnames and child process calls to evade static detection. Telemetry evasion is implemented via environment variables and rate-limiting markers. The binary payload is opaque, unverified, and unrelated to the package's declared functionality, indicating a supply chain compromise or malicious intent.

If executed, the malicious binary could run arbitrary code on the host system without user consent or awareness, potentially leading to system compromise. The obfuscation and telemetry evasion techniques reduce the likelihood of detection by automated scanners or monitoring tools. Because the binary is unpinned and unverified, its contents and capabilities are unknown, increasing risk. This compromises the integrity of the development environment and any systems where this package is installed.

No official patch or remediation is currently documented. Users should immediately cease using delivery-ci-jira version 35.5.2 and remove it from their environments. Verify package integrity before installation and prefer packages from trusted sources. Monitor for updates or advisories from the package maintainers or npm registry. Consider scanning existing environments for presence of this package and any spawned binaries. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.