The delivery-ci-jira-rnd npm package version 35.5.4 includes malicious functionality where its index.js loads a _bridge.js module that selects a platform-specific endpoint to download a binary over HTTPS from obfuscated Cloudflare Workers hosts. The package uses string literal splitting and DNS-TXT covert channels to evade static detection. The downloaded binary is saved to hidden, masquerading paths in temporary directories, given executable permissions, and executed detached via shell commands. Execution is controlled by a TTL stamp file and falsely labeled as telemetry, indicating intentional evasion and malicious intent.

This malicious package can execute arbitrary binaries on the host system, potentially leading to unauthorized code execution, persistence, and evasion of detection. The obfuscation and covert channels complicate detection and analysis, increasing risk to users who install this specific package version.

No official patch or remediation is currently available. Users should avoid installing or using delivery-ci-jira-rnd version 35.5.4. Investigate and remove this package if present. Monitor for suspicious binaries in temporary directories and unusual network activity related to Cloudflare Workers or sdk.dl.wel1.ru domains. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.