The delivery-ci-microforms npm package (version 35.3.5) includes malicious functionality that triggers automatically when the package is installed or required. The main module loads a support script that dynamically reconstructs platform-specific endpoints to fetch opaque binary payloads from multiple ephemeral Cloudflare Workers domains or via DNS TXT records. These binaries are saved to temporary directories with misleading filenames, made executable, and executed detached from the parent process using shell commands. The package further obfuscates its use of the child_process module by reconstructing its name at runtime and gates the malicious payload execution behind environment variable checks intended to appear as telemetry opt-outs. This design enables stealthy, attacker-controlled code execution on the victim's machine.

Successful installation or requiring of this package results in arbitrary code execution on the affected system. The attacker-controlled binaries run detached and with executable permissions, potentially allowing full compromise of the host environment. The obfuscation and use of ephemeral hosting make detection and attribution more difficult. This poses a high risk to developers and systems that incorporate this package, as it can lead to unauthorized system access and control.

No official patch or remediation is currently available for this malicious package. Users should immediately avoid installing or requiring delivery-ci-microforms version 35.3.5. Remove any existing installations of this package from projects and systems. Employ strict package source verification and use trusted package registries. Monitor for suspicious activity related to this package and consider using tools that detect malicious npm packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.